CVE-2026-61627

None

CVSS

—

EPSS

—

Published

Oct 30, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A subtitle processing library can be tricked by specially made files into crashing or corrupting memory in video and media software.

Chainable

Exploitation: Requires User Interaction
Attacker needs: User Interaction
Complexity: High
Impact: Denial Of Service
Component: Library
Class: Buffer Overflow
Remediation: Upgrade
Effort: Low
Patch risk: Low

What it actually does

Buffer overread and overwrite of the glyph array in wrap_lines_measure during ASS subtitle rendering, allowing writes of attacker-controllable offsets beyond allocated memory when specific backslash-n sequences are present in non-default wrap modes.

Why it matters to the business

Media players, video editors, and other applications relying on libass for subtitle rendering may crash or experience memory corruption when processing untrusted ASS files, potentially disrupting content playback and distribution workflows.

How an attack unfolds

An attacker crafts an ASS subtitle file containing a final line of backslash-n sequences that survives trimming, supplies it to a vulnerable application, and triggers rendering so the measurement loops overshoot the glyph array, writing beyond its bounds.

How to fix it

Upgrade libass to version 0.17.5 or later in all affected software distributions and rebuild any statically linked dependents.

How to confirm the fix worked

Verify installed libass version is 0.17.5 or newer via package manager or library inspection, and confirm absence of the wrap_lines_measure overshoot condition through code review or fuzz testing with crafted ASS input.

Typical attack path

Craft malicious ASS subtitle containing specific literal backslash-n sequences in non-two wrap mode
Deliver the subtitle file to a target application using libass
Trigger subtitle rendering in the vulnerable wrap mode
Achieve memory overwrite for denial of service or potential further corruption

How to detect it

Search application logs and crash reports for segmentation faults or memory errors occurring during ASS subtitle rendering; inspect for unusual process behavior when handling subtitle files from untrusted sources.

What your security team should do

Prioritize upgrade of libass to 0.17.5 across all media and video processing systems
Disable processing of untrusted ASS subtitles until patched
Monitor upstream advisories for dependent applications

The record

libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.

Affected packages

Ecosystem	Package	Introduced	Fixed