Buffer Overflow in libass Portable Subtitle Renderer
CVE-2026-61627

7.3HIGH

Key Information:

Vendor

Libass

Status
Libass
Vendor
CVE Published:
30 October 2026

What is CVE-2026-61627?

A buffer overflow vulnerability has been identified in libass, a widely used portable subtitle renderer for ASS/SSA formats. This issue arises due to improper handling of glyph array measurements in the wrap_lines_measure function when rendering crafted ASS content prior to version 0.17.5. Maliciously structured subtitle files can cause the glyph measurement loops to overshoot the allocated array, leading to an out-of-bounds write. Although actual exploitation is primarily theoretical and constrained by various factors, it presents a potential avenue for denial of service attacks. It is recommended to upgrade to version 0.17.5 or later to mitigate this risk.

Affected Version(s)

libass < 0.17.5

References

https://github.com/libass/libass/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/libass/libass/commit/f2ef59755292bc4bb...
x_refsource_MISC
https://github.com/libass/libass/releases/tag/0.17.5
x_refsource_MISC

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.