Quick answers
- Is CVE-2026-61626 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-61626 being exploited in the wild.
- How severe is CVE-2026-61626?
- Informational severity, published 30 October 2026.
- Which products and versions are affected?
- Libass 0.17.4 to 0.17.4.
- Is there a fix for CVE-2026-61626?
- Yes: fixed in 0.17.5. Until then: Disable read-order checking by calling ass_set_check_readorder with a zero argument if event pruning is not required, or avoid loading untrusted Matroska streams with subtitle content.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-61626 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-61626?
- Check whether you run Libass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.17.5
Disable read-order checking by calling ass_set_check_readorder with a zero argument if event pruning is not required, or avoid loading untrusted Matroska streams with subtitle content.</anigation> </invoke>
Technical details
The vulnerability is a bit-clearing memory corruption in the clear_read_order_bit function, triggered when processing Matroska packets with negative ReadOrder field values. With read-order checking enabled and later event pruning, negative values cause bit clears at attacker-controlled offsets near the NULL pointer, typically in the upper 256 MiB of address space on systems with arithmetic right shift. Exploitation to achieve code execution is strongly constrained by ASLR, the read-only nature of the bit operations, and architectural limitations.
Affected products
- libass libass 0.17.4 to 0.17.4
Timeline
- 2026-10-30: disclosed