---
id: CVE-2026-61627
title: 'libass: Out-of-bounds read and write in wrap_lines_measure'
summary: >-
  libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation
  Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread
  and overwrite the glyph array in `wrap_lines_measure` while rendering
  malicious `…
severity: high
cvss: 7.3
cvssVector: 'CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
  - CWE-787
vendor: libass
product: libass
affected:
  - libass < 0.17.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T15:34:57.627086Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:51:10.521Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61627'
references:
  - url: 'https://github.com/libass/libass/security/advisories/GHSA-pjjp-65r7-ppgm'
    label: 'https://github.com/libass/libass/security/advisories/GHSA-pjjp-65r7-ppgm'
  - url: >-
      https://github.com/libass/libass/commit/f2ef59755292bc4bb950ef22710e18a5487c399d
    label: >-
      https://github.com/libass/libass/commit/f2ef59755292bc4bb950ef22710e18a5487c399d
  - url: 'https://github.com/libass/libass/releases/tag/0.17.5'
    label: 'https://github.com/libass/libass/releases/tag/0.17.5'
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04668
ingestedAt: '2026-11-05T16:07:30.498Z'
---

## Overview

libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.

## Affected

- `libass < 0.17.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.