Ansilove libansilove through version 1.4.2 contains an out‑of‑bounds read during the processing of compressed XBIN run‑length records. The routine fails to verify that a record’s length fits within the remaining input buffer, which allows an attacker to craft a file ending in a control byte such as 0x7F that causes the library to read past the buffer boundary. This flaw can trigger a crash in applications rendering the malicious artwork and may expose adjacent memory content to the process, potentially leaking sensitive data.

Any installation of ansilove libansilove that accepts XBIN files is affected. The library is embedded in graphic editors, image viewers, and other software that support the XBIN format, including both desktop clients and server‑side components that might receive untrusted artwork.

The CVSS score of 6.8 marks moderate severity, and the EPSS score of less than 1% suggests current exploitation risk is low. The vulnerability is not listed in CISA’s KEV catalog. An attacker only needs to supply a crafted XBIN file; no special privileges or authentication are required beyond the user or system rendering the file. Successful exploitation leads to a crash and the potential disclosure of memory content.