CVE-2026-61626

libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream loaded through `ass_process_chunk`, enabled read-order checking, and later pruning of the malicious events. Read-order checking is enabled by default unless `ass_set_check_readorder` is called with zero; pruning must occur explicitly through `ass_prune_events` or through automatic pruning previously enabled with `ass_configure_prune`. On common systems with arithmetic right shift, 32-bit int values, the upper address region reserved to the kernel, and matching binary/kernel architecture, the expected consequence is denial of service. More extensive exploitation on uncommon systems is theoretical and strongly constrained by the target addresses, bit-clearing-only mutation, and ASLR. This issue is fixed in version 0.17.5.

• CWE-787

• https://github.com/libass/libass/commit/23da65a130bb8c5b2cf0c7df0dd7d424607f98f1
• https://github.com/libass/libass/releases/tag/0.17.5
• https://github.com/libass/libass/security/advisories/GHSA-5gf7-wjfm-vmvm

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61614SolidInvoice is an open-source invoicing platform. Prior to …5.9
• CVE-2026-61617Wings is the server control plane for the Pterodactyl game-s…7.7
• CVE-2026-61618SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5…6.9
• CVE-2026-6162A vulnerability has been found in PHPGurukul Company Visitor…3.5
• CVE-2026-61620HoneySQL turns Clojure data structures into SQL. From 2.0.0 …9.8
• CVE-2026-61625VictoriaMetrics is a scalable solution for monitoring and ma…6.8
• CVE-2026-61627libass is a portable subtitle renderer for the `ASS`/SSA (Ad…7.3
• CVE-2026-61628nginx ignition is a user interface for the nginx web server.…8.1
• CVE-2026-61629nginx ignition is a user interface for the nginx web server.…7.5
• CVE-2026-6163A vulnerability was identified in code-projects Lost and Fou…7.3
• CVE-2026-61630nginx ignition is a user interface for the nginx web server.…4.2
• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3