Heap-Based Buffer Overflow in libass by Libav

CVE-2020-36430

What is CVE-2020-36430?

The libass library prior to version 0.15.1 is vulnerable to a heap-based buffer overflow in the decode_chars function, which is invoked by both decode_font and process_text functions. This vulnerability arises from the misuse of an integer data type during subtraction operations that can lead to memory corruption and potentially allow an attacker to execute arbitrary code or crash the affected application. It is important for users and developers to update to the latest version to mitigate security risks associated with this flaw.

References