libass CVE-2026-95127

Exploitation requires the victim application built on libass 0.17.5 to parse and render an attacker-supplied ASS/SSA subtitle file; crafted layout values cause 32-bit integer overflow in ass_outline_construct() and related bbox/pen-advance arithmetic in ass_render.c. No authentication is required (PR:N) and complexity is low (AC:L). Limiting factors: the attacker must get the malicious subtitle loaded and rendered - via an embedded or sidecar subtitle in a media file, or an auto-fetched/auto-processed subtitle in a server pipeline - and the impact is confined to denial of service (crash/abort) with no confidentiality or integrity effect. Fully resolved only by updating libass with the PR #955 changes; no partial mitigation is stated in the sources.

The signals point to a real but moderate-priority issue rather than an urgent emergency. The CVSS 3.1 score is 7.5 (High), but that entire weight comes from availability (C:N/I:N/A:H) - this is a pure denial-of-service, not code execution or data exposure. Supporting signals are weak-to-moderate: EPSS is only 0.26% (17th percentile), indicating low modelled probability of widespread exploitation, and there is no CISA KEV listing, so there is no evidence of active exploitation. The vuln.today decision label is 'this_week', which is a routine-but-prompt priority consistent with a network-reachable, unauthenticated DoS in a widely-embedded library. A public PoC reference exists (a gist plus the upstream issue/PR), but it is not verified as working exploit code. One important data discrepancy: the CVE is labelled CWE-400 (Uncontrolled Resource Consumption), yet the actual fix (PR #955) addresses signed 32-bit integer overflow in bbox/pen-advance arithmetic (wrap_i32/int64 casts) in the layout and outline-construction path - the labelled weakness class does not match the observed root cause, so the mechanism is integer overflow leading to a crash/abort rather than resource exhaustion; treat the CWE-400 tag with caution. Net: a credible, low-complexity remote DoS worth patching on a normal cycle, not a drop-everything event.

An attacker crafts a malicious ASS/SSA subtitle file whose glyph/line-layout values drive the integer arithmetic in ass_outline_construct() and related layout code past the 32-bit range. When a victim application built on libass 0.17.5 renders the subtitle - for example a media player loading a sidecar/embedded subtitle, or a server-side transcoding/thumbnailing pipeline auto-processing it - the overflow produces invalid outline geometry that crashes or aborts the renderer. A public PoC reference exists (gist and upstream issue #947); it is not verified as working exploit code.