Arbitrary Code Execution Vulnerability in Aegisub Subtitle Editor

CVE-2026-92705

What is CVE-2026-92705?

Aegisub, a popular cross-platform advanced subtitle editor, has a vulnerability that allows arbitrary code execution due to its insufficient handling of Automation scripts. Users of Aegisub versions 3.2.0 through 3.4.2 may unknowingly execute malicious code when opening ASS subtitle files that reference untrusted scripts. Additionally, from versions 3.4.0 to 3.4.2, the software's handling of embedded NUL characters creates further security concerns. This issue is addressed in version 3.5.0, emphasizing the importance of updating to mitigate risks.

References