UBUNTU-CVE-2026-61627

libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wrap_lines_measure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point pos.x value, although that value is not subsequently used. The second loop writes pos.x and pos.y beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.

References

Affected packages

Ubuntu:Pro:24.04:LTS / libass

Package

Name: libass
Purl: pkg:deb/ubuntu/libass?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:0.17.1-2ubuntu0.1~esm1

Affected versions

1:0.*

1:0.17.1-1

1:0.17.1-2

1:0.17.1-2build1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "libass9",
            "binary_version": "1:0.17.1-2ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-61627.json"

Ubuntu:Pro:26.04:LTS / libass