CVE-2026-21089

HighCVSS 7.8

Published: 09/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

Risk Assessment

A local attacker can write out-of-bounds memory, potentially causing crashes or arbitrary code execution.

Recommendation

Apply the SMR Sep-2026 Release 1 patch to fix the vulnerability.

Other vulnerabilities in libsubextractor.so

CVE-2026-21088High
Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

Original NVD description (English source)

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS