Every CVE Search/ Get API key

CVE-2020-26682

In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer...

8.8 HighFix available

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.80%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
CVE-2020-26682
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
CVE-2020-26682
Updated
2026-11-02
EUVDEUVD-2020-19224 No score

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
EUVD-2020-19224
Updated
2026-11-03
GitHub AdvisoriesGHSA-87rf-m79q-qqqf 8.8

In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer...

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
GHSA-87rf-m79q-qqqf
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSV 8.8

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
CVE-2020-26682
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-26682 8.8

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
DEBIAN-CVE-2020-26682
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVJLSEC-2026-155 8.8

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
JLSEC-2026-155
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVUBUNTU-CVE-2020-26682 8.8

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow.

Record
UBUNTU-CVE-2020-26682
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2021-0017 No score

Updated libass packages fix security vulnerability

In libass 0.14.0, the ass_outline_construct's call to outline_stroke causes a signed integer overflow. (CVE-2020-26682)

Record
MGASA-2021-0017
Updated
2026-11-02
OSVopenSUSE-SU-2021:0472-1 No score

Security update for libass

This update for libass fixes the following issues:

  • CVE-2020-26682: Fixed a signed integer overflow in the call to outline_stroke() (bsc#1177862).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0472-1
Updated
2026-11-02
OSVSUSE-SU-2021:0936-1 No score

Security update for libass

This update for libass fixes the following issues:

  • CVE-2020-26682: Fixed a signed integer overflow in the call to outline_stroke() (bsc#1177862).
Record
SUSE-SU-2021:0936-1
Updated
2026-11-02
OSVUSN-8815-1 No score

libass vulnerabilities

It was discovered that libass incorrectly handled parsing operations for specific nested character strings. An attacker could use this issue to cause libass to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-24994)

It was discovered that libass incorrectly handled certain outline processing operations. An attacker could use this issue to cause libass to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-26682)

It was discovered that libass incorrectly handled certain ASS subtitle files when measuring wrapped lines. An attacker could use this issue to cause libass to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-61627)

It was discovered that libass incorrectly handled certain Matroska subtitle chunks with negative ReadOrder values. An attacker could use this issue to cause libass to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-61626)

Record
USN-8815-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libass
Debian:12
 before 1:0.15.0-1
1:0.15.0-1
libass
Debian:13
 before 1:0.15.0-1
1:0.15.0-1
libass
Debian:14
 before 1:0.15.0-1
1:0.15.0-1
libass_jll
Julia
 before 0.15.1+0
0.15.1+0
libass
Mageia:7
 before 0.15.0-1.mga7
0.15.0-1.mga7
libass
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 0.14.0-3.3.1
0.14.0-3.3.1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
libass
SUSE:Linux Enterprise Server 15-LTSS
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise Server for SAP Applications 15
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Manager Proxy 4.0
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Manager Retail Branch Server 4.0
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Manager Server 4.0
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
SUSE:Enterprise Storage 6
 before 0.14.0-3.3.1
0.14.0-3.3.1
libass
Ubuntu:Pro:18.04:LTS
 before 1:0.14.0-1ubuntu0.1~esm1, plus listed versions
1:0.13.7-21:0.14.0-1
1:0.14.0-1ubuntu0.1~esm1
libass
Ubuntu:Pro:20.04:LTS
 before 1:0.14.0-2ubuntu0.1~esm1, plus listed versions
1:0.14.0-2
1:0.14.0-2ubuntu0.1~esm1
libass
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 0.10.1-3ubuntu1+esm2, plus listed versions
0.10.1-1ubuntu10.10.1-30.10.1-3ubuntu10.10.1-3ubuntu1+esm1
0.10.1-3ubuntu1+esm2
libass
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 1:0.14.0-1ubuntu0.1~esm1, plus listed versions
1:0.13.7-21:0.14.0-1
1:0.14.0-1ubuntu0.1~esm1
libass
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 1:0.14.0-2ubuntu0.1~esm1, plus listed versions
1:0.14.0-2
1:0.14.0-2ubuntu0.1~esm1
libass
Ubuntu:Pro:24.04:LTS
From an advisory covering 4 CVEs
 before 1:0.17.1-2ubuntu0.1~esm1, plus listed versions
1:0.17.1-11:0.17.1-21:0.17.1-2build1
1:0.17.1-2ubuntu0.1~esm1
libass
Ubuntu:Pro:26.04:LTS
From an advisory covering 4 CVEs
 before 1:0.17.4-2ubuntu0.1~esm1, plus listed versions
1:0.17.3-11:0.17.4-2
1:0.17.4-2ubuntu0.1~esm1
libass
openSUSE:Leap 15.2
 before 0.14.0-lp152.4.3.1
0.14.0-lp152.4.3.1

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-26682 is a high vulnerability (CVSS 8.8) in Libass Project Libass, published October 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. Fixed in libass 1:0.15.0-1.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open