Denial of Service in libass via ass_outline_construct()

Executive Summary

This vulnerability is a denial of service issue in libass version 0.17.5. It occurs due to a flaw in the ass_outline_construct() function located in libass/ass_render.c. A remote attacker could exploit this to cause the application to crash or become unresponsive.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using libass 0.17.5 when processing subtitle files with extreme values. Use tools like AddressSanitizer or UndefinedBehaviorSanitizer during compilation to catch integer overflows and float-to-int conversion issues. Check for SIGILL crashes in logs when rendering subtitles with parameters like PlayResX, Fontsize, or override values such as \frx.

Useful 0 Not Useful 0

Impact Analysis

If you use software that relies on libass v0.17.5, an attacker could send specially crafted input to trigger this flaw. This may lead to application crashes, service disruptions, or degraded performance for affected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service via crashes in libass rendering functions due to integer overflows and float-to-int conversion issues. It does not directly impact data confidentiality or integrity but may disrupt subtitle rendering in applications handling media content. Compliance with GDPR or HIPAA is not directly affected unless subtitle rendering is a critical component of regulated data processing, which is unlikely.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade libass to a patched version addressing CVE-2026-95127, such as the fix in libass/libass#955. Avoid processing untrusted subtitle files with extreme values. If upgrading is not possible, implement input validation to reject subtitle files with excessively large numeric parameters before rendering.

Useful 0 Not Useful 0