Executive brief
libcaca is a software library used to convert images into color ASCII art. A vulnerability in how the library handles canvas imports allows an attacker to provide a specially crafted file that causes the application to crash or potentially execute unauthorized code. This could lead to a loss of data confidentiality or a complete system compromise if the library is used to process untrusted files.
Technical details
An integer overflow vulnerability exists in libcaca's canvas import functionality, specifically within the `caca_resize()` function. The root cause is an insufficient overflow check that fails to prevent `width` and `height` values from wrapping to zero when multiplied in a 32-bit context. This leads to a small heap allocation via `malloc()` in `caca_create_frame()`, followed by an out-of-bounds write in `caca_put_char()` because the boundary checks use the original large width/height values. An attacker can achieve a controlled heap overflow by providing a malicious file in the ".caca" format. This issue is a regression/incomplete fix for a previous vulnerability (CVE-2021-3410) and has been addressed in commit fb77acff9ba6bb01d53940da34fb10f20b156a23.
Affected products
- cacalabs libcaca <= 0.99.beta20
Timeline
- 2025-10-20: other: Issue reported on GitHub
- 2026-04-25: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD