CVE-2026-95127

The check_allocations function in libass/ass_shaper.c in libass before version 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.

Buffer overflow in the calc_coeff function in ass_blur.c in libass before version 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.

The wrap_lines_smart function in ass_render.c in libass before version 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to '0/3 line wrapping equalization.'

In libass prior to 0.17.5, wrap_lines_measure can overread and overwrite the glyph array while rendering malicious ASS content. In certain wrap modes, a line ending with a literal backslash-n sequence can cause the measurement loops to overshoot by one glyph, leading to an uninitialized read and an out-of-bounds write. The issue is fixed in version 0.17.5.

In libass from 0.17.4 until 0.17.5, event pruning does not guard against negative Matroska ReadOrder values, allowing an attacker to clear bits at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream, enabled read-order checking, and later pruning of malicious events. The issue is fixed in version 0.17.5.