CVE-2026-61626

Name of the Vulnerable Software and Affected Versions libass versions 0.17.4 through 0.17.4

Description Event pruning does not guard against negative Matroska ReadOrder values, which allows an attacker to clear arbitrarily many bits to zero at controlled positions near the NULL pointer. This occurs when a malicious Matroska stream is loaded through the ass process chunk function, read-order checking is enabled, and the malicious events are subsequently pruned via the ass prune events function or through automatic pruning enabled by ass configure prune. On common systems with 32-bit integer values and arithmetic right shift, this typically results in a denial of service.

Recommendations Update to version 0.17.5.