CVE-2026-21089: Input Validation

Q: Is this exposed to remote attackers?

The available information identifies the attacker as local. It does not indicate that remote exploitation is possible.

Q: Which releases are affected?

libsubextractor.so versions prior to SMR Sep-2026 Release 1 are affected.

Published Sep 9, 2026

Updated

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

Affected Software

1 affected component

libsubextractor.so<SMR Sep-2026 Release 1

Event History

Sep 9, 2026

CVE Published

via MITRE·04:47 AM

Data Sourced

via MITRE·04:47 AM

DescriptionWeakness

Frequently Asked Questions

Is this exposed to remote attackers?

The available information identifies the attacker as local. It does not indicate that remote exploitation is possible.

Which releases are affected?

libsubextractor.so versions prior to SMR Sep-2026 Release 1 are affected.