{"id":"CVE-2020-24994","aliases":["DEBIAN-CVE-2020-24994","EUVD-2020-17694","GHSA-qrhf-wgfc-f8cx","JLSEC-2026-154","SUSE-SU-2021:1664-1","UBUNTU-CVE-2020-24994","USN-4797-1","USN-8815-1","openSUSE-SU-2021:0773-1","openSUSE-SU-2021:1664-1"],"status":"published","title":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.14.0 allows...","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0265,"percentile":0.85751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770","CWE-787"],"published":"2021-03-23T19:32:27Z","modified":"2026-11-03T21:18:32Z","fixes":[{"ecosystem":"Debian:12","package":"libass","fixed_in":["1:0.15.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libass","fixed_in":["1:0.15.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libass","fixed_in":["1:0.15.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libass_jll","fixed_in":["0.15.1+0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libass","fixed_in":["0.14.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libass","fixed_in":["0.14.0-3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libass","fixed_in":["0.10.1-3ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libass","fixed_in":["0.13.1-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libass","fixed_in":["1:0.14.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libass","fixed_in":["1:0.14.0-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libass","fixed_in":["0.14.0-lp152.4.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libass","fixed_in":["0.14.0-3.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.15.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.15.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.15.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"libass_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.15.1+0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3ubuntu1+esm2"}]}],"versions":["0.10.1-1ubuntu1","0.10.1-3","0.10.1-3ubuntu1","0.10.1-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-1ubuntu0.1~esm2"}]}],"versions":["0.12.3-2","0.13.0-1","0.13.1-1","0.13.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.14.0-1ubuntu0.1~esm1"}]}],"versions":["1:0.13.7-2","1:0.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.14.0-2ubuntu0.1~esm1"}]}],"versions":["1:0.14.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3ubuntu1+esm1"}]}],"versions":["0.10.1-1ubuntu1","0.10.1-3","0.10.1-3ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-1ubuntu0.1~esm2"}]}],"versions":["0.12.3-2","0.13.0-1","0.13.1-1","0.13.1-1ubuntu0.1~esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3ubuntu1+esm2"}]}],"versions":["0.10.1-1ubuntu1","0.10.1-3","0.10.1-3ubuntu1","0.10.1-3ubuntu1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.14.0-1ubuntu0.1~esm1"}]}],"versions":["1:0.13.7-2","1:0.14.0-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.14.0-2ubuntu0.1~esm1"}]}],"versions":["1:0.14.0-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.17.1-2ubuntu0.1~esm1"}]}],"versions":["1:0.17.1-1","1:0.17.1-2","1:0.17.1-2build1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.17.4-2ubuntu0.1~esm1"}]}],"versions":["1:0.17.3-1","1:0.17.4-2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-lp152.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-3.6.1"}]}]}],"products":[{"vendor":"libass_project","product":"libass"}],"references":[{"url":"https://github.com/libass/libass/issues/422","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/libass/libass/issues/423","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/libass/libass/issues/422#issuecomment-806002919","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/libass/libass/commit/6835731c2fe4164a0c50bc91d12c43b2a2b4e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24994"},{"url":"https://github.com/advisories/GHSA-qrhf-wgfc-f8cx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-24994","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211664-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184153","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24994","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-24994","tags":["report"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4892","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4797-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24994","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8815-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61627","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RSOO525LAGINT6Q7P6QLOLGYVE43LSBA/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GYONME5VDBAM5FSXOCS4YFULDEBSTWDL/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-24994","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2021-03-23T19:32:27Z","modified":"2024-08-04T15:26:08.815Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2020-17694","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2021-03-23T19:32:27Z","modified":"2024-08-04T15:26:08Z","updated_at":"2026-11-03T03:07:18.658916Z"}],"ghsa":[{"id":"GHSA-qrhf-wgfc-f8cx","title":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.14.0 allows...","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.14.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2022-05-24T17:45:04Z","modified":"2023-01-27T05:03:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:42:16.196802Z"}],"nvd":[{"id":"CVE-2020-24994","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2021-03-23T20:15:13.073Z","modified":"2026-06-17T03:06:13.203Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-24994","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2021-03-23T20:15:13.073Z","modified":"2026-10-20T10:52:52.277964323Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-24994","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2021-03-23T20:15:13.073Z","modified":"2026-10-26T12:01:47.598175107Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"JLSEC-2026-154","description":"Stack overflow in the `parse_tag` function in `libass/ass_parse.c` in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2026-04-20T18:02:38.348Z","modified":"2026-07-25T18:23:56.73473426Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2020-24994","description":"Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.","status":"published","published":"2021-03-23T20:15:00Z","modified":"2026-09-25T00:42:20.4265753Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"openSUSE-SU-2021:0773-1","title":"Security update for libass","description":"This update for libass fixes the following issues:\n\n- CVE-2020-24994: Fixed a stack overflow in the parse_tag (bsc#1184153).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-05-23T12:05:26Z","modified":"2026-02-04T03:59:33.422151Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1664-1","title":"Security update for libass","description":"This update for libass fixes the following issues:\n\n- CVE-2020-24994: Fixed a stack overflow in the parse_tag (bsc#1184153).\n","status":"published","published":"2021-07-10T18:48:30Z","modified":"2025-05-07T18:11:52.132536Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:1664-1","title":"Security update for libass","description":"This update for libass fixes the following issues:\n\n- CVE-2020-24994: Fixed a stack overflow in the parse_tag (bsc#1184153).\n","status":"published","published":"2021-05-20T06:03:38Z","modified":"2025-05-02T04:30:37.973765Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4797-1","title":"libass vulnerabilities","description":"It was discovered that LibASS incorrectly handled certain ASS files. A remote\nattacker could possibly use this issue to cause a denial of service. One of\nthe issues, CVE-2016-7970, only affected Ubuntu 16.04 ESM.\n(CVE-2016-7969, CVE-2016-7970, CVE-2016-7972)\n\nIt was discovered that LibASS incorrectly handled parsing operations for\nspecific nested character strings. An attacker could possibly use this issue\nto cause a denial of service. This issue was only fixed in Ubuntu 16.04 LTS.\n(CVE-2020-24994)\n","status":"published","published":"2022-05-04T10:38:06Z","modified":"2026-06-29T13:48:23.423049716Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-8815-1","title":"libass vulnerabilities","description":"It was discovered that libass incorrectly handled parsing operations for\nspecific nested character strings. An attacker could use this issue to\ncause libass to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2020-24994)\n\nIt was discovered that libass incorrectly handled certain outline\nprocessing operations. An attacker could use this issue to cause libass\nto crash, resulting in a denial of service. This issue only affected\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-26682)\n\nIt was discovered that libass incorrectly handled certain ASS subtitle\nfiles when measuring wrapped lines. An attacker could use this issue to\ncause libass to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 24.04 LTS and\nUbuntu 26.04 LTS. (CVE-2026-61627)\n\nIt was discovered that libass incorrectly handled certain Matroska\nsubtitle chunks with negative ReadOrder values. An attacker could use\nthis issue to cause libass to crash, resulting in a denial of service,\nor possibly execute arbitrary code. This issue only affected Ubuntu\n26.04 LTS. (CVE-2026-61626)","status":"published","published":"2026-09-24T14:57:46Z","modified":"2026-11-03T21:18:32.82470971Z","updated_at":"2026-11-03T21:43:43.010304Z"}]}}