CVE-2026-61627

libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.

• CWE-125
• CWE-787

• https://github.com/libass/libass/commit/f2ef59755292bc4bb950ef22710e18a5487c399d
• https://github.com/libass/libass/releases/tag/0.17.5
• https://github.com/libass/libass/security/advisories/GHSA-pjjp-65r7-ppgm
• https://lists.debian.org/debian-lts-announce/2026/09/msg00004.html

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61617Wings is the server control plane for the Pterodactyl game-s…7.7
• CVE-2026-61618SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5…6.9
• CVE-2026-6162A vulnerability has been found in PHPGurukul Company Visitor…3.5
• CVE-2026-61620HoneySQL turns Clojure data structures into SQL. From 2.0.0 …9.8
• CVE-2026-61625VictoriaMetrics is a scalable solution for monitoring and ma…6.8
• CVE-2026-61626libass is a portable subtitle renderer for the ASS/SSA (Adva…7.3
• CVE-2026-61628nginx ignition is a user interface for the nginx web server.…8.1
• CVE-2026-61629nginx ignition is a user interface for the nginx web server.…7.5
• CVE-2026-6163A vulnerability was identified in code-projects Lost and Fou…7.3
• CVE-2026-61630nginx ignition is a user interface for the nginx web server.…4.2
• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3
• CVE-2026-61633NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ clien…2