Skip to content
OpenAdvisories
High USN-8815-1 4 CVEs

libass vulnerabilities

Published Sep 24, 2026 · Updated Nov 3, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libass incorrectly handled parsing operations for
specific nested character strings. An attacker could use this issue to
cause libass to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-24994)

It was discovered that libass incorrectly handled certain outline
processing operations. An attacker could use this issue to cause libass
to crash, resulting in a denial of service. This issue only affected
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-26682)

It was discovered that libass incorrectly handled certain ASS subtitle
files when measuring wrapped lines. An attacker could use this issue to
cause libass to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-61627)

It was discovered that libass incorrectly handled certain Matroska
subtitle chunks with negative ReadOrder values. An attacker could use
this issue to cause libass to crash, resulting in a denial of service,
or possibly execute arbitrary code. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-61626)

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS libass 0.10.1-3ubuntu1+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libass 1:0.14.0-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libass 1:0.14.0-2ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS libass 1:0.17.1-2ubuntu0.1~esm1
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS libass 1:0.17.4-2ubuntu0.1~esm1

Vulnerabilities 4

  • High 7.3
    CVE-2026-61626

    libass: Out-of-bounds bit clears for negative Matroska ReadOrder values

    libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker to clear arbitrarily …

    libass libass libass libass Debian Ubuntu
  • High 7.3
    CVE-2026-61627

    libass: Out-of-bounds read and write in wrap_lines_measure

    libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap…

    libass libass libass libass Debian Ubuntu
  • Unscored —
    CVE-2020-24994

    Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause…

    libass libass Debian Ubuntu
  • Unscored —
    CVE-2020-26682

    In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow.

    libass libass Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-24994
  • report
    https://ubuntu.com/security/CVE-2020-26682
  • report
    https://ubuntu.com/security/CVE-2026-61626
  • report
    https://ubuntu.com/security/CVE-2026-61627