The vulnerability is a NULL pointer dereference in libansilove versions 1.3.0 through 1.4.2. A specially crafted XBIN file can cause the library to index a NULL high_font_data_xbin pointer during drawing, which terminates the host process. This results in a denial of service because the application handling the file crashes.

Any installation of the ansilove library, specifically libansilove versions 1.3.0 to 1.4.2, is vulnerable. Applications that load XBIN files via libansilove are affected, as the flaw resides in the core loader and character drawing routines. The problem exists in the upstream source released on GitHub and is present in all builds of the affected range.

The CVSS score of 6.8 indicates medium severity for denial of service. The EPSS score of less than 1% implies that automated exploitation is currently unlikely, but a determined attacker could craft a malicious XBIN file to target vulnerable software. Since the flaw requires the delivery of a specific file, exploitation would typically involve supplying the payload to an application that processes XBIN data. The vulnerability is not listed in the CISA KEV catalog, so it is not yet a known exploited vulnerability in the wild.