CVE-2026-92705
- Source
- https://cve.org/CVERecord?id=CVE-2026-92705
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92705.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-92705
- Aliases
-
- GHSA-67hq-5vgg-6f23
- Downstream
- Published
- 2026-10-09T20:37:58Z
- Modified
- 2026-10-28T11:00:54Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Aegisub executes arbitrary code through automatically loaded Automation scripts
- Details
-
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by
Automation Scriptsmetadata inASSsubtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a craftedASSfile together with a referenced malicious Automation script, and opening theASfile executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embeddedNULcharacters between extension validation and filesystem operations additionally allows a craftedASS/Luapolyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-158", "CWE-829" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92705.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92705.json
- https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23
- https://nvd.nist.gov/vuln/detail/CVE-2026-92705
- https://github.com/TypesettingTools/Aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff
- https://github.com/TypesettingTools/Aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6
- https://github.com/TypesettingTools/Aegisub/commit/e4099055711cce327840870c050ce46e58f4aee0
Affected packages
Git / github.com/typesettingtools/aegisub
Affected ranges
- Type
- GIT
- Repo
- https://github.com/typesettingtools/aegisub
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "3.2.0" }, { "fixed": "3.5.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "0a3073d59f10432eeebea65018b02ef4d0a87fff" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e4099055711cce327840870c050ce46e58f4aee0" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92705.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "297913394838006257977939655020631017604",
"length": 307
},
"id": "CVE-2026-92705-046e8384",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6",
"target": {
"file": "src/ass_parser.cpp",
"function": "AssParser::ParseMetadataLine"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"65789750913398799151788185279564685439",
"68884008159766980214666549823642983774",
"254993420649616114518330891911074313810",
"307433222880683362335711524340597996174",
"98918420366876508166107003260019241242",
"46010356103349783772453659659927637799",
"119642786202988964063618964687057956596",
"17458192575685042237614099641978069505",
"174257633184558231884693897521835167592",
"109198071340953334066598780695537540059",
"46552602213065322648418228163534936855",
"164253810444980791087131157678433648065",
"113193187258704482572052540750338323187",
"99696356911038775612664779998608695722",
"308981881531990278370603105087549771893",
"229691140279273757150314856779021695315",
"109728789418729574683069561865140406650",
"201730756598213706034199045027916412122",
"21233391047798798959663333321633153767",
"244208011496462942269626731623725178736",
"273626675932461506956671659609149304775",
"217825504011586220086000180962176713262",
"196274551741093891346080470712100410526"
],
"threshold": 0.9
},
"id": "CVE-2026-92705-0fecabfe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/e4099055711cce327840870c050ce46e58f4aee0",
"target": {
"file": "src/auto4_base.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "63216833812505810010865651380835673510",
"length": 907
},
"id": "CVE-2026-92705-3ce4c656",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6",
"target": {
"file": "src/ass_parser.cpp",
"function": "AssParser::ParseExtradataLine"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"73254139070309691928000974497278780407",
"174580960835583491552409076963181674271",
"87620570954342429190275354490499875070",
"4772629093353042341274998811503759814"
],
"threshold": 0.9
},
"id": "CVE-2026-92705-6769503b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6",
"target": {
"file": "src/ass_parser.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4649642339399945969638527936849558461",
"length": 1266
},
"id": "CVE-2026-92705-81962dc8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/e4099055711cce327840870c050ce46e58f4aee0",
"target": {
"file": "src/auto4_base.cpp",
"function": "LocalScriptManager::Reload"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"245107269408514329255527771236002696493",
"222507216250350444858445990800306767889",
"30407424653601168592411274093541465097",
"25226756387606778410061978114165443504"
],
"threshold": 0.9
},
"id": "CVE-2026-92705-8c1d02c0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff",
"target": {
"file": "libaegisub/common/fs.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288938258967667064595355224828451900693",
"260877989083769923178206194352677530760",
"9058311769138493594901975359310282420",
"286108547194390020689216049794546461968",
"252717162103636501964169537100134609455",
"257819223173895781789464428469321702049",
"115661704975933341436691642526920287968",
"126201674277073770368662050760103450236",
"308590410053193839474346113715067986609",
"60889040486457857231259008734434757095",
"215952827115456940736404857127164387528",
"6326998583820879045639479005394347730",
"288556989405289407173129226219137342848",
"275293298390880800006746420046325677340",
"24064349552569742427096307467014113577"
],
"threshold": 0.9
},
"id": "CVE-2026-92705-98bb81d0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6",
"target": {
"file": "src/ass_parser.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "189384967113498168673372983353482426497",
"length": 287
},
"id": "CVE-2026-92705-a813be53",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff",
"target": {
"file": "libaegisub/common/fs.cpp",
"function": "HasExtension"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "229030329218065982818250397952909236687",
"length": 1176
},
"id": "CVE-2026-92705-b602edbd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/43af875ea01e80052cc6c44f24fc8c5258261c6d",
"target": {
"file": "src/aegisublocale.cpp",
"function": "AegisubLocale::PickLanguage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"162832351147539314534832991064079368407",
"239616441170838098595780047429577270978",
"72160399562424001750473232206754001221",
"285317962338956580939918036367318023050",
"136755522439778451603729984384458215187",
"223976700954118620005570584674807511468",
"165130768443351865965467250555023662007",
"329660081426147882683406997946034259143"
],
"threshold": 0.9
},
"id": "CVE-2026-92705-f20bdf97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/typesettingtools/aegisub/commit/43af875ea01e80052cc6c44f24fc8c5258261c6d",
"target": {
"file": "src/aegisublocale.cpp"
}
}
]
vanir_signatures_modified
"2026-10-28T11:00:54Z"