{"id":"CVE-2026-61627","kind":"vulnerability","aliases":["CVE-2026-61627"],"related":[],"title":"libass: subtitle rendering overread and overwrite can crash or corrupt memory","description":"libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.","summary":"libass, a library that draws subtitles in video players, can read and write past the end of a glyph array when it renders crafted ASS subtitle files. The sources say no exploitation beyond possible denial of service is known, and broader abuse is theoretical.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["libass","media-tools","package","video-players"],"not_affected_if":["no-untrusted-ass-subtitles"],"how_to_check":"- Check the installed libass version, for example with `pkg-config --modversion libass`\n- Look for libass in the dependencies of players or apps that render ASS/SSA subtitles","fix":"- libass `0.17.5`","status":"open","published_at":"2026-10-30T15:16:52+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:24+00:00","updated_at":"2026-10-30T15:33:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T15:33:24Z","model":"claude-haiku-5-5","output":{"fix":"- libass `0.17.5`","reach":"unknown","title":"libass: subtitle rendering overread and overwrite can crash or corrupt memory","impact":"medium","summary":"libass, a library that draws subtitles in video players, can read and write past the end of a glyph array when it renders crafted ASS subtitle files. The sources say no exploitation beyond possible denial of service is known, and broader abuse is theoretical.","audience":"developers","category":"package","nicknames":[],"who_cares":["libass","video-players","media-tools"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Crash via denial of service; memory corruption theoretically possible","analyst_note":"","how_to_check":"- Check the installed libass version, for example with `pkg-config --modversion libass`\n- Look for libass in the dependencies of players or apps that render ASS/SSA subtitles","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-ass-subtitles"],"who_is_affected":"Applications that link libass and render ASS/SSA subtitles from files or streams they do not fully control, such as media players and video tools. Systems that never render ASS subtitles from untrusted input can skip it. The sources do not describe further conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4394,"output_tokens":479,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61627':14A,17A '/ssa':79C '0.17.5':88C,233C '32':167C 'abus':67B 'actual':205C 'add':195C 'address':222C 'advanc':80C 'alloc':156C 'alpha':83C 'alpha/substation':82C 'although':174C 'array':45B,96C,159C,190C 'aslr':226C 'ass':50B,78C,104C 'attack':198C 'attacker-control':197C 'backslash':120C 'backslash-n':119C 'beyond':58B,188C,207C 'bit':168C 'broader':66B,214C 'capac':160C 'consist':125C 'constrain':219C 'content':105C 'control':199C 'corrupt':10A 'craft':49B 'crash':8A 'cve':12A,15A 'denial':60B,209C 'draw':30B 'earli':135C 'end':41B,115C 'exact':153C 'exploit':57B,206C,215C 'file':52B 'final':113C 'first':162C,193C 'fix':170C,230C 'fixed-point':169C 'format':85C 'glyph':44B,95C,147C,158C 'glyph-array':157C 'issu':228C 'known':64B,213C 'libass':1A,18B,26B,70C,89C 'librari':28B 'limit':223C 'line':99C,114C,141C 'line-measur':140C 'liter':118C 'loop':143C,163C,183C 'make':138C 'malici':103C 'match':154C 'measur':100C,142C 'media':20B 'media-tool':19B 'memori':11A 'mode':108C 'n':121C 'offset':200C 'one':146C 'otherwis':124C 'overread':4A,91C 'overshoot':144C 'overwrit':6A,93C 'packag':22B 'past':39B 'player':25B,34B 'point':171C 'portabl':73C 'pos.x':172C,185C 'pos.y':187C 'possibl':59B,208C 'prior':86C 'read':36B,164C 'remain':133C 'render':3A,48B,75C,102C 'say':55B 'second':182C,203C 'sequenc':122C,129C 'servic':62B,211C 'size':152C 'sourc':54B 'space':131C 'subsequ':179C 'substat':81C 'subtitl':2A,31B,51B,74C,84C 'text':151C 'theoret':69B,217C 'tool':21B 'total':150C 'trim':136C 'two':111C 'uniniti':166C 'use':180C 'valu':173C,176C 'version':232C 'video':24B,33B 'video-play':23B 'wrap':98C,107C 'write':38B,184C,224C 'zero':191C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libass and render ASS/SSA subtitles from files or streams they do not fully control, such as media players and video tools. Systems that never render ASS subtitles from untrusted input can skip it. The sources do not describe further conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T15:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61627","severity":null,"published_at":"2026-10-30T15:16:52+00:00","modified_at":"2026-10-30T15:16:52+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}