CVE-2026-61627
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In libass prior to 0.17.5, wrap_lines_measure can overread and overwrite the glyph array while rendering malicious ASS content. In certain wrap modes, a line ending with a literal backslash-n sequence can cause the measurement loops to overshoot by one glyph, leading to an uninitialized read and an out-of-bounds write. The issue is fixed in version 0.17.5.
Risk Assessment
A denial of service is possible via a malicious subtitle file. Broader exploitation is theoretical and constrained by addresses, limited writes, and ASLR.
Recommendation
Update libass to version 0.17.5 or later. Avoid rendering untrusted ASS files with vulnerable versions.
Other vulnerabilities in libass
See all- CVE-2016-7972High
The check_allocations function in libass/ass_shaper.c in libass before version 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.
- CVE-2016-7970High
Buffer overflow in the calc_coeff function in ass_blur.c in libass before version 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.
- CVE-2016-7969High
The wrap_lines_smart function in ass_render.c in libass before version 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to '0/3 line wrapping equalization.'
- CVE-2026-61626High
In libass from 0.17.4 until 0.17.5, event pruning does not guard against negative Matroska ReadOrder values, allowing an attacker to clear bits at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream, enabled read-order checking, and later pruning of malicious events. The issue is fixed in version 0.17.5.
- CVE-2026-95127High
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c
Original NVD description (English source)
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS