CVE-2026-95127: Libass libass vulnerability
Published Oct 13, 2026
·Updated
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the assoutlineconstruct() in libass/assrender.c
Affected Software
1 affected component
libass libass=0.17.5
Event History
Oct 13, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:17 PM
Description
Frequently Asked Questions
1
What must an attacker control to trigger the denial of service?
The issue is reachable through ass_outline_construct() in libass/ass_render.c. The provided information identifies it as remotely triggerable, but does not specify the exact input format or delivery path required.
2
What impact is documented?
The documented impact is denial of service. No information is provided indicating code execution, data disclosure, or privilege escalation.
3
How can I determine whether an installation is affected?
Review the libass version in use and the source revision for the fix referenced in pull request 955. The provided information identifies libass 0.17.5 as affected, but does not provide a fixed release version.