---
id: "CVE-2026-61627"
kind: "vulnerability"
aliases: ["CVE-2026-61627"]
title: "libass: subtitle rendering overread and overwrite can crash or corrupt memory"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["libass", "media-tools", "package", "video-players"]
not_affected_if: ["no-untrusted-ass-subtitles"]
published_at: "2026-10-30T15:16:52+00:00"
first_seen_at: "2026-10-30T15:31:11+00:00"
updated_at: "2026-10-30T15:33:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61627", "first_seen_at": "2026-10-30T15:31:11+00:00"}]
---

# libass: subtitle rendering overread and overwrite can crash or corrupt memory

libass, a library that draws subtitles in video players, can read and write past the end of a glyph array when it renders crafted ASS subtitle files. The sources say no exploitation beyond possible denial of service is known, and broader abuse is theoretical.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed libass version, for example with `pkg-config --modversion libass`
- Look for libass in the dependencies of players or apps that render ASS/SSA subtitles

## Fix

- libass `0.17.5`

## Timeline

- 2026-10-30T15:31:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61627

## From the sources

libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_