Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61627— libass: Out-of-bounds read and write in wrap_lines_measure

Quick assessment

Affected
libass libass
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libass 是一个可移植的字幕渲染器，用于处理 /SSA（Advanced Substation Alpha/Substation Alpha）字幕格式。在 0.17.5 版本之前，当渲染恶意的 内容时，libass 在 函数中可能会越界读取并覆盖字形数组。在除模式二之外的其他换行模式下，若某行以字面意义上的反斜杠加 n（ ）序列结尾，且该行其余部分仅由此类序列或空格组成，则可能在早期修剪后仍残留该行，导致行测量循环多迭代一个字形。当文本总大小恰好等于已分配的字形数组容量时，第一个循环会读取一个未初始化的 32

CVSS 7.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61627

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libass: Out-of-bounds read and write in wrap_lines_measure
Source: CVE Program / CVE List V5
Vulnerability Description
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libass libass < 0.17.5 -

II. Public POCs for CVE-2026-61627

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61627

请登录查看更多情报信息。

Other References for CVE-2026-61627 (3)

IV. Related Vulnerabilities

Same product: libass
Same vendor: libass
Same weakness: CWE-125