{"id":"UBUNTU-CVE-2026-42046","details":"libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the \"caca\" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.","modified":"2026-05-27T14:00:05.943514751Z","published":"2026-05-11T22:22:00Z","related":["USN-8318-1"],"upstream":["CVE-2026-42046"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-42046"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-42046"},{"type":"REPORT","url":"https://github.com/cacalabs/libcaca/security/advisories/GHSA-4vvg-vrqv-m56w"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8318-1"}],"affected":[{"package":{"name":"libcaca","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=esm-infra-legacy%2Ftrusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.beta18-1ubuntu2","0.99.beta18-1ubuntu3","0.99.beta18-1ubuntu4","0.99.beta18-1ubuntu5","0.99.beta18-1ubuntu5.1","0.99.beta18-1ubuntu5.1+esm1","0.99.beta18-1ubuntu5.1+esm2","0.99.beta18-1ubuntu5.1+esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"caca-utils","binary_version":"0.99.beta18-1ubuntu5.1+esm3"},{"binary_name":"libcaca0","binary_version":"0.99.beta18-1ubuntu5.1+esm3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}},{"package":{"name":"libcaca","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=esm-infra%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.beta19-2build2~gcc5.1","0.99.beta19-2build2~gcc5.2","0.99.beta19-2ubuntu0.16.04.1","0.99.beta19-2ubuntu0.16.04.2","0.99.beta19-2ubuntu0.16.04.2+esm1","0.99.beta19-2ubuntu0.16.04.2+esm2"],"ecosystem_specific":{"binaries":[{"binary_name":"caca-utils","binary_version":"0.99.beta19-2ubuntu0.16.04.2+esm2"},{"binary_name":"libcaca0","binary_version":"0.99.beta19-2ubuntu0.16.04.2+esm2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}},{"package":{"name":"libcaca","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.beta19-2build2~gcc5.2","0.99.beta19-2build2~gcc5.3","0.99.beta19-2ubuntu0.18.04.1","0.99.beta19-2ubuntu0.18.04.2","0.99.beta19-2ubuntu0.18.04.3","0.99.beta19-2ubuntu0.18.04.3+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"caca-utils","binary_version":"0.99.beta19-2ubuntu0.18.04.3+esm1"},{"binary_name":"libcaca0","binary_version":"0.99.beta19-2ubuntu0.18.04.3+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}},{"package":{"name":"libcaca","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.beta19-2.1","0.99.beta19-2.1ubuntu1","0.99.beta19-2.1ubuntu1.20.04.1","0.99.beta19-2.1ubuntu1.20.04.2","0.99.beta19-2.1ubuntu1.20.04.2+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"caca-utils","binary_version":"0.99.beta19-2.1ubuntu1.20.04.2+esm1"},{"binary_name":"libcaca0","binary_version":"0.99.beta19-2.1ubuntu1.20.04.2+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}},{"package":{"name":"libcaca","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2.2ubuntu4.2"}]}],"versions":["0.99.beta19-2.2ubuntu2","0.99.beta19-2.2ubuntu3","0.99.beta19-2.2ubuntu4","0.99.beta19-2.2ubuntu4.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"caca-utils","binary_version":"0.99.beta19-2.2ubuntu4.2"},{"binary_name":"libcaca0","binary_version":"0.99.beta19-2.2ubuntu4.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}},{"package":{"name":"libcaca","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-4ubuntu0.2"}]}],"versions":["0.99.beta20-3build1","0.99.beta20-4","0.99.beta20-4build1","0.99.beta20-4build2","0.99.beta20-4ubuntu0.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"0.99.beta20-4ubuntu0.2","binary_name":"caca-utils"},{"binary_version":"0.99.beta20-4ubuntu0.2","binary_name":"libcaca0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}},{"package":{"name":"libcaca","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-5ubuntu0.25.10.2"}]}],"versions":["0.99.beta20-5","0.99.beta20-5ubuntu0.25.10.1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.99.beta20-5ubuntu0.25.10.2","binary_name":"caca-utils"},{"binary_name":"libcaca0","binary_version":"0.99.beta20-5ubuntu0.25.10.2"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}},{"package":{"name":"libcaca","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libcaca?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-6ubuntu2.1"}]}],"versions":["0.99.beta20-5","0.99.beta20-6","0.99.beta20-6ubuntu1","0.99.beta20-6ubuntu2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"caca-utils","binary_version":"0.99.beta20-6ubuntu2.1"},{"binary_name":"libcaca0","binary_version":"0.99.beta20-6ubuntu2.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42046.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}