Aegisub
Monthly
Arbitrary code execution in Aegisub 3.2.0 through 3.4.2 occurs when a victim opens a crafted .ass subtitle project whose 'Automation Scripts' metadata references an attacker-supplied Lua Automation script, which Aegisub auto-loads without prompting the user to trust the script or its author and runs with the privileges of the Aegisub process. Versions 3.4.0 through 3.4.2 add a single-file attack path in which inconsistent handling of embedded NUL characters between extension validation and filesystem operations lets a crafted ASS/Lua polyglot reference and execute itself, removing the need to deliver a separate script file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making it a local, user-interaction-driven issue that does not affect any network service; there is no public exploit identified at time of analysis, so real-world urgency is moderate rather than critical, and Aegisub 3.5.0 fixes the vulnerability.
Arbitrary code execution in Aegisub 3.2.0 through 3.4.2 occurs when a victim opens a crafted .ass subtitle project whose 'Automation Scripts' metadata references an attacker-supplied Lua Automation script, which Aegisub auto-loads without prompting the user to trust the script or its author and runs with the privileges of the Aegisub process. Versions 3.4.0 through 3.4.2 add a single-file attack path in which inconsistent handling of embedded NUL characters between extension validation and filesystem operations lets a crafted ASS/Lua polyglot reference and execute itself, removing the need to deliver a separate script file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making it a local, user-interaction-driven issue that does not affect any network service; there is no public exploit identified at time of analysis, so real-world urgency is moderate rather than critical, and Aegisub 3.5.0 fixes the vulnerability.