{"id":"CVE-2026-95127","aliases":["DEBIAN-CVE-2026-95127","EUVD-2026-98802","GHSA-cc4w-frwq-w2m3","UBUNTU-CVE-2026-95127"],"status":"published","title":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the...","description":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00435,"percentile":0.38255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2026-10-13T00:00:00Z","modified":"2026-10-28T01:09:07Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.17.1-1","1:0.17.1-1+deb12u1","1:0.17.1-2","1:0.17.2-1","1:0.17.2-2","1:0.17.3-1","1:0.17.4-1","1:0.17.4-2","1:0.17.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.17.3-1","1:0.17.3-1+deb13u1","1:0.17.4-1","1:0.17.4-2","1:0.17.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.17.3-1","1:0.17.4-1","1:0.17.4-2","1:0.17.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1-1ubuntu1","0.10.1-3","0.10.1-3ubuntu1","0.10.1-3ubuntu1+esm1","0.10.1-3ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.3-2","0.13.0-1","0.13.1-1","0.13.1-1ubuntu0.1~esm1","0.13.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.13.7-2","1:0.14.0-1","1:0.14.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.14.0-2","1:0.14.0-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.15.0-2","1:0.15.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.17.1-1","1:0.17.1-2","1:0.17.1-2build1","1:0.17.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.17.4-2","1:0.17.4-2build1","1:0.17.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.17.3-1","1:0.17.4-2","1:0.17.4-2ubuntu0.1~esm1"]}],"references":[{"url":"https://github.com/libass/libass/issues/947","tags":["report"]},{"url":"https://github.com/libass/libass/pull/955","tags":["report"]},{"url":"https://github.com/libass/libass/pull/955/changes/d570c2f5ed55844ec9b77b085deb3cb8ef59cb4a","tags":["report"]},{"url":"https://gist.github.com/1820893135-pixel/5aee1e778240351c744ce5496eef3285","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95127"},{"url":"https://github.com/advisories/GHSA-cc4w-frwq-w2m3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-95127","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-95127","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95127","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-95127","description":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-26T16:39:02.9Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:05.505362Z"}],"euvd":[{"id":"EUVD-2026-98802","description":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-26T16:39:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:29.132426Z"}],"ghsa":[{"id":"GHSA-cc4w-frwq-w2m3","title":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the...","description":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","status":"published","published":"2026-10-13T15:32:27Z","modified":"2026-10-26T18:33:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:14:25.232123Z"}],"nvd":[{"id":"CVE-2026-95127","description":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","status":"published","published":"2026-10-13T15:17:51.92Z","modified":"2026-10-26T17:17:31.583Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:57.132005Z"}],"osv":[{"id":"DEBIAN-CVE-2026-95127","description":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","status":"published","published":"2026-10-13T15:17:51.92Z","modified":"2026-10-27T10:02:21.33755178Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"UBUNTU-CVE-2026-95127","description":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","status":"published","published":"2026-10-13T15:17:00Z","modified":"2026-10-28T01:09:07.101542163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"}]}}