{"id":"CVE-2026-61627","title":"libass: Out-of-bounds read and write in wrap_lines_measure","summary":"libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `…","severity":"high","cvss":7.3,"cvssVector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-125","CWE-787"],"vendor":"libass","product":"libass","affected":["libass < 0.17.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T15:34:57.627086Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T15:51:10.521Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61627","references":[{"url":"https://github.com/libass/libass/security/advisories/GHSA-pjjp-65r7-ppgm","label":"https://github.com/libass/libass/security/advisories/GHSA-pjjp-65r7-ppgm"},{"url":"https://github.com/libass/libass/commit/f2ef59755292bc4bb950ef22710e18a5487c399d","label":"https://github.com/libass/libass/commit/f2ef59755292bc4bb950ef22710e18a5487c399d"},{"url":"https://github.com/libass/libass/releases/tag/0.17.5","label":"https://github.com/libass/libass/releases/tag/0.17.5"}],"tags":["cve.org"],"epss":0.00155,"epssPercentile":0.04668,"ingestedAt":"2026-11-05T16:07:30.498Z","slug":"CVE-2026-61627","body":"## Overview\n\nlibass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.\n\n## Affected\n\n- `libass < 0.17.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}