libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the "caca" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22175-1 advisory.

    This update for libcaca fixes the following issue

    - CVE-2026-42046: an integer overflow vulnerability in libcaca's canvas import functionality may allow an     attacker to       cause a controlled heap out-of-bounds write (bsc#1264984).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2423-1 advisory.

    This update for libcaca fixes the following issue

    - CVE-2026-42046: an integer overflow vulnerability in libcaca's canvas import functionality may allow an     attacker to       cause a controlled heap out-of-bounds write (bsc#1264984).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2424-1 advisory.

    This update for libcaca fixes the following issue

    - CVE-2026-42046: an integer overflow vulnerability in libcaca's canvas import functionality may allow an     attacker to       cause a controlled heap out-of-bounds write (bsc#1264984).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2394-1 advisory.

    This update for libcaca fixes the following issue

    - CVE-2026-42046: an integer overflow vulnerability in libcaca's canvas import functionality may allow an     attacker to       cause a controlled heap out-of-bounds write (bsc#1264984).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8318-1 advisory.

    It was discovered that libcaca incorrectly handled certain malformed files. An attacker could use this     issue to cause libcaca to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1151ae6bdf advisory.

    Automatic update for libcaca-0.99-0.83.beta20.fc45.

    ##### **Changelog**

    ```
    * Tue May 26 2026 Xavier Bachelot <xavier@bachelot.org> - 0.99-0.83.beta20
    - Fix CVE-2026-42046 (RHBZ#2475408)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in     libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write     (heap overflow) by supplying a crafted file in the caca format. Depending on the build configuration and     memory allocator, this may lead to memory corruption or remote code execution. This is the same     vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit     fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability. (CVE-2026-42046)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322907	SUSE SLES16 Security Update : libcaca (SUSE-SU-2026:22175-1)	Nessus	SuSE Local Security Checks	high
321645	SUSE SLED15 / SLES15 Security Update : libcaca (SUSE-SU-2026:2423-1)	Nessus	SuSE Local Security Checks	high
321605	SUSE SLES15 Security Update : libcaca (SUSE-SU-2026:2424-1)	Nessus	SuSE Local Security Checks	high
321603	SUSE SLES12 Security Update : libcaca (SUSE-SU-2026:2394-1)	Nessus	SuSE Local Security Checks	high
317468	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : libcaca vulnerability (USN-8318-1)	Nessus	Ubuntu Local Security Checks	high
316866	Fedora 45 : libcaca (2026-1151ae6bdf)	Nessus	Fedora Local Security Checks	high
314738	Linux Distros Unpatched Vulnerability : CVE-2026-42046	Nessus	Misc.	high

Detections

Analytics

CVE-2026-42046

high

Tenable Plugins

high

high

high

high

high

high

high