PT-2026-39852 · Libcaca+2 · Libcaca+2

Gh05T-1337 + 2 · Published 2026-05-11 · Updated 2026-05-28 · CVE-2026-42046

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libcaca versions 0.99.beta20 and earlier

Description An integer overflow in the canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the "caca" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution.

Recommendations Apply the fix provided in commit fb77acff9ba6bb01d53940da34fb10f20b156a23.

Exploit

Fix

RCE

Integer Overflow

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-122

CWE-787

Related Identifiers

CVE-2026-42046

OPENSUSE-SU-2026:10834-1

USN-8318-1

Affected Products

Linuxmint

Ubuntu

Libcaca

References · 16

• 🔥 https://github.com/cacalabs/libcaca/security/advisories/GHSA-4vvg-vrqv-m56w · Exploit
• https://osv.dev/vulnerability/USN-8318-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10834-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42046 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42046 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42046 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42046 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42046 · Security Note
• https://ubuntu.com/security/notices/USN-8318-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42046 · Security Note
• https://github.com/cacalabs/libcaca/commit/fb77acff9ba6bb01d53940da34fb10f20b156a23 · Note
• https://github.com/cacalabs/libcaca/issues/86 · Note
• https://reddit.com/r/linuxmint/comments/1tpxegb/psa_usn_alerts_for_libcaca_gstreamer_ubuntu · Reddit Post
• https://suse.com/security/cve/CVE-2026-42046 · Note
• https://twitter.com/VulmonFeeds/status/2054046183853617532 · Twitter Post