Live › vulnerability › CVE-2026-61626
libass, a subtitle rendering library, does not check negative Matroska ReadOrder values during event pruning, so a malicious Matroska stream can clear bits at attacker-chosen positions near a NULL pointer. On common systems the expected result is a denial of service (crash), and more extensive exploitation is described as theoretical and tightly constrained.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Applications that link libass 0.17.4 and render subtitles from Matroska streams that may be untrusted, with read-order checking on (the default) and event pruning in use. Players and tools that only render trusted files, or that never prune events, are much less exposed. unknown whether any specific distribution has a different default.
No product ranges from the sources yet.
pkg-config --modversion libass, and see whether it falls in 0.17.4 through 0.17.4 before 0.17.5.ass_process_chunk with pruning enabled via ass_prune_events or ass_configure_prune.0.17.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream loaded through ass_process_chunk, enabled read-order checking, and later pruning of the malicious events. Read-order checking is enabled by default unless ass_set_check_readorder is called with zero; pruning must occur explicitly through ass_prune_events or through automatic pruning previously enabled with ass_configure_prune. On common systems with arithmetic right shift, 32-bit int values, the upper address region reserved to the kernel, and matching binary/kernel architecture, the expected consequence is denial of service. More extensive exploitation on uncommon systems is theoretical and strongly constrained by the target addresses, bit-clearing-only mutation, and ASLR. This issue is fixed in version 0.17.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-61626")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.