Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61626— libass: Out-of-bounds bit clears for negative Matroska ReadOrder values

Quick assessment

Affected
libass libass
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libass 是一款用于 ASS/SSA（Advanced Substation Alpha/Substation Alpha）字幕格式的可移植字幕渲染库。在版本 0.17.4 至 0.17.5 之间，libass 的事件剪枝（event pruning）机制未对 Matroska 容器中的负值 字段进行防护，导致攻击者能够在靠近 NULL 指针的、由攻击者控制的位置，将任意数量的位清零。 利用该漏洞需要满足以下条件：通过 加载恶意的 Matroska 流、启用读序检查（read-order checking），并

CVSS 7.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61626

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libass: Out-of-bounds bit clears for negative Matroska ReadOrder values
Source: CVE Program / CVE List V5
Vulnerability Description
libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream loaded through `ass_process_chunk`, enabled read-order checking, and later pruning of the malicious events. Read-order checking is enabled by default unless `ass_set_check_readorder` is called with zero; pruning must occur explicitly through `ass_prune_events` or through automatic pruning previously enabled with `ass_configure_prune`. On common systems with arithmetic right shift, 32-bit int values, the upper address region reserved to the kernel, and matching binary/kernel architecture, the expected consequence is denial of service. More extensive exploitation on uncommon systems is theoretical and strongly constrained by the target addresses, bit-clearing-only mutation, and ASLR. This issue is fixed in version 0.17.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libass libass >= 0.17.4, < 0.17.5 -

II. Public POCs for CVE-2026-61626

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61626

请登录查看更多情报信息。

Other References for CVE-2026-61626 (3)

IV. Related Vulnerabilities

Same product: libass
Same vendor: libass
Same weakness: CWE-787