CVE-2026-61626: Debian/libass vulnerability
GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative Matroska ReadOrder values
Affected Software
1 affected componentFixes available
debian/libass
1:0.17.1-11:0.17.1-1+deb12u11:0.17.3-1+deb13u11:0.17.5-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libassto a version that resolves this vulnerability.Fixed in 1:0.17.1-1Fixed in 1:0.17.1-1+deb12u1Fixed in 1:0.17.3-1+deb13u1Fixed in 1:0.17.5-1
Event History
Sep 24, 2026
CVE Published
via Debian·07:11 PM
Data Sourced
via Debian·07:11 PM
DescriptionAffected Software
Sep 25, 2026
Data Sourced
via Ubuntu·07:11 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to trigger the issue?
The issue is associated with Matroska content containing negative ReadOrder values, which can cause out-of-bounds bit-clear operations.