Out-of-bounds write in libass - CVE-2026-61626
Published: July 22, 2026
Vulnerability identifier: #VU139174
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-61626
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: libass
Affected software:
libass
libass
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in read-order handling in the ass_process_chunk API when processing malformed Matroska packets with negative ReadOrder values. A remote attacker can supply a crafted Matroska stream to cause a denial of service.
Exploitation requires read-order checking to be enabled and malicious events to be pruned either explicitly or through automatic pruning after it has been enabled. User interaction is required to load the crafted Matroska stream.
How to mitigate CVE-2026-61626
Install security update from vendor's website.