CVE-2026-92705

Name of the Vulnerable Software and Affected Versions Aegisub versions 3.2.0 through 3.4.2

Description Aegisub automatically loads Automation scripts referenced by the Automation Scripts metadata in ASS subtitle projects without verifying user trust in the scripts or their authors. This allows an attacker to execute arbitrary code with the privileges of the Aegisub process by distributing a crafted ASS file and a malicious Automation script. Additionally, in versions 3.4.0 through 3.4.2, inconsistent handling of embedded NUL characters between extension validation and filesystem operations enables a crafted ASS/Lua polyglot—a file that is valid in two different formats—to reference and execute itself as a single-file variant.

Recommendations Update Aegisub to version 3.5.0.