An integer overflow in libcaca’s canvas import functionality causes a controlled heap out‑of‑bounds write. If an attacker supplies a crafted file in the "caca" format, the overflow may corrupt memory or enable remote code execution. The vulnerability is identical to CVE-2021-3410 but the initial fix was incomplete; the commit fb77acff9ba6bb01d53940da34fb10f20b156a23 now fully resolves the flaw.

The affected vendor is cacalabs, product libcaca. Versions 0.99.beta20 and all older releases are impacted, because the heap overflow occurs in the pre‑beta20 code paths of the canvas import functions. Any installation that links against an unpatched libcaca library and processes untrusted "caca" format files is susceptible.

The CVSS base score is 7.8, indicating high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide a malicious file to the application’s import routine; thus the likely attack vector is local file‑based. If the affected application accepts files from network or other untrusted sources, remote execution may be possible, making the risk significant in those contexts.