CVE-2020-36430
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from...
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- Record
CVE-2020-36430- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- Record
CVE-2020-36430- Updated
- 2026-11-02
EUVDEUVD-2020-23958 No score
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- Record
EUVD-2020-23958- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pqvw-6c6x-gvwh
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from...
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- Record
GHSA-pqvw-6c6x-gvwh- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- Record
CVE-2020-36430- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-36430
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- Record
DEBIAN-CVE-2020-36430- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2021-1303
libass security update
libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. It is mostly compatible with VSFilter.
Security Fix(es):
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.(CVE-2020-36430)
- Record
OESA-2021-1303- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-36430
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- Record
UBUNTU-CVE-2020-36430- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0413 No score
Updated libass packages fix security vulnerability
Updated libass packages fix security vulnerability:
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction (CVE-2020-36430).
- Record
MGASA-2021-0413- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1174-1 No score
Security update for libass
This update for libass fixes the following issues:
- CVE-2020-36430: Fixed heap-based buffer overflow in decode_chars (bsc#1188539).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:1174-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2792-1 No score
Security update for libass
This update for libass fixes the following issues:
- CVE-2020-36430: Fixed heap-based buffer overflow in decode_chars (bsc#1188539).
- Record
openSUSE-SU-2021:2792-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2792-1 No score
Security update for libass
This update for libass fixes the following issues:
- CVE-2020-36430: Fixed heap-based buffer overflow in decode_chars (bsc#1188539).
- Record
SUSE-SU-2021:2792-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libassDebian:12 |
before 1:0.15.0-2 | 1:0.15.0-2 |
libassDebian:13 |
before 1:0.15.0-2 | 1:0.15.0-2 |
libassDebian:14 |
before 1:0.15.0-2 | 1:0.15.0-2 |
libassMageia:8 |
before 0.15.1-1.mga8 | 0.15.1-1.mga8 |
libassopenEuler:20.03-LTS-SP2 |
before 0.15.0-2.oe1 | 0.15.0-2.oe1 |
libassSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libassSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise Server 15-LTSS |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise Server 15 SP1-BCL |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise Server for SAP Applications 15 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Manager Proxy 4.0 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Manager Retail Branch Server 4.0 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Manager Server 4.0 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassSUSE:Enterprise Storage 6 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
libassopenSUSE:Leap 15.2 |
before 0.14.0-lp152.4.9.1 | 0.14.0-lp152.4.9.1 |
libassopenSUSE:Leap 15.3 |
before 0.14.0-3.9.1 | 0.14.0-3.9.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36430 is a high vulnerability (CVSS 7.8) in Libass Project Libass, published July 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in libass 1:0.15.0-2.
References
github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml
bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JUXFQUJ32GWG5E46A63DFDCYJAF3VU6
security.gentoo.org/glsa/202208-13
nvd.nist.gov/vuln/detail/CVE-2020-36430
Show 14 moreShow less
security-tracker.debian.org/tracker/CVE-2020-36430
advisories.mageia.org/MGASA-2021-0413.html
bugs.mageia.org/show_bug.cgi?id=29392
lists.suse.com/pipermail/sle-security-updates/2021-August/009325.html
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1303
suse.com/support/update/announcement/2021/suse-su-20212792-1
bugzilla.suse.com/1188539
ubuntu.com/security/CVE-2020-36430
cve.org/CVERecord?id=CVE-2020-36430
lists.opensuse.org/archives/list/[email protected]/thread/UM3NSAZAHOVXI7OL5NKRPHCXG5LZTLKM