CVE-2026-95127

EUVD-2026-98802
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.53%
Debian logo
Debian Releases
Debian Product
Codename
libass
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libass
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
References
https://gist.github.com/1820893135-pixel/5aee1e778240351c744ce5496eef3285
https://github.com/libass/libass/issues/947
https://github.com/libass/libass/pull/955
https://github.com/libass/libass/pull/955/changes/d570c2f5ed55844ec9b77b085deb3cb8ef59cb4a