CVE-2026-61626

A flaw was found in libass. When handling subtitle streams, the library's event pruning mechanism fails to properly validate negative Matroska ReadOrder values. An attacker who provides a specially crafted media stream to an application using libass can trigger memory corruption, resulting in an...

CVE-2026-61626 libass: Out-of-bounds bit clears for negative Matroska ReadOrder values

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...