SB2026072292 - Multiple vulnerabilities in libass

Description

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2026-61626)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in read-order handling in the ass_process_chunk API when processing malformed Matroska packets with negative ReadOrder values. A remote attacker can supply a crafted Matroska stream to cause a denial of service.

Exploitation requires read-order checking to be enabled and malicious events to be pruned either explicitly or through automatic pruning after it has been enabled. User interaction is required to load the crafted Matroska stream.

2) Out-of-bounds write (CVE-ID: CVE-2026-61627)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in wrap_lines_measure when parsing malicious ASS content. A remote attacker can trick the victim into loading crafted ASS content to cause a denial of service.

User interaction is required to load the crafted ASS content.

Remediation

Install update from vendor's website.

References

• https://github.com/libass/libass/security/advisories/GHSA-5gf7-wjfm-vmvm
• https://github.com/libass/libass/commit/23da65a130bb8c5b2cf0c7df0dd7d424607f98f1
• https://github.com/libass/libass/security/advisories/GHSA-pjjp-65r7-ppgm
• https://github.com/libass/libass/commit/f2ef59755292bc4bb950ef22710e18a5487c399d