OPENSUSE-SU-2026:12515-1 libass-devel-0.17.5-2.1 on GA media

These are all security issues fixed in the libass-devel-0.17.5-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-61626

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

SUSE CVE-2026-61627

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...

CLEANSTART-2024-XV52151 check_allocations function in libass/ass_shaper

Security vulnerability affects the libass package. The checkallocations function in libass/assshaper...

CLEANSTART-2024-AO55203 Buffer overflow in the calc_coeff function in libass/ass_blur

Security vulnerability affects the libass package. Buffer overflow in the calccoeff function in libass/assblur...

CLEANSTART-2024-TX79455 wrap_lines_smart function in ass_render

Security vulnerability affects the libass package. The wraplinessmart function in assrender...

CVE-2026-61626

A flaw was found in libass. When handling subtitle streams, the library's event pruning mechanism fails to properly validate negative Matroska ReadOrder values. An attacker who provides a specially crafted media stream to an application using libass can trigger memory corruption, resulting in an...

CVE-2026-61627

A flaw was found in libass. An attacker could exploit this vulnerability by enticing a user to process a specially crafted subtitle file, triggering an out-of-bounds write during line measurement. Successful exploitation may result in arbitrary code execution or cause an application crash leading...

CVE-2026-61626

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61627

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...

CVE-2026-61627 libass: Out-of-bounds read and write in wrap_lines_measure

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...

CVE-2026-61627

The libass subtitle renderer (used in players like mpv , VLC , and FFmpeg ) contains a heap-buffer overflow in the wrap_lines_measure function. When rendering malicious ASS/SSA content, specifically lines ending with literal backslash-n sequences in certain wrap modes, the measurement loops can o...

CVE-2026-61627 libass: Out-of-bounds read and write in wrap_lines_measure

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...

CVE-2026-61627 libass: Out-of-bounds read and write in wrap_lines_measure

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...

EUVD-2026-114007

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...

CVE-2026-61626

The libass subtitle renderer (versions 0.17.4 through 0.17.5 ) is vulnerable to an out-of-bounds bit clear because event pruning fails to guard negative Matroska ReadOrder values. An attacker can provide a malicious Matroska stream via ass_process_chunk with enabled read-order checking; subsequen...

CVE-2026-61626 libass: Out-of-bounds bit clears for negative Matroska ReadOrder values

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

EUVD-2026-114006

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61626 libass: Out-of-bounds bit clears for negative Matroska ReadOrder values

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61627: libass: libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...