libass vulnerabilities
CVEs whose affected-version data names the libass package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-61626High· 7.3libass: Out-of-bounds bit clears for negative Matroska ReadOrder values
libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker…
▾ Twilightlibass · libassEPSS 0.12%via CVEORG
CVE-2026-61627High· 7.3libass: Out-of-bounds read and write in wrap_lines_measure
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `…
▾ Twilightlibass · libassEPSS 0.15%via CVEORG