# CVE-2026-95127: libass signed integer overflow in ass_outline_construct

Source: https://junglewise.ai/threats/cve-2026-95127-an-issue-in-libass-v-0-17-5-allows-a-remote-attacker-to-cause-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-95127 · Severity: info · Published 2026-10-13

libass is a library used to render subtitle files in various video players and media applications. A vulnerability in version 0.17.5 allows an attacker to craft a malicious subtitle file that causes the application to crash when attempting to render it, resulting in a denial of service for users viewing the subtitle.

Technologies: [Libass](https://junglewise.ai/threats/technologies/libass-libass). Vendors: [Libass](https://junglewise.ai/threats/vendors/libass).

## Quick answers

**Is CVE-2026-95127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95127 being exploited in the wild.

**How severe is CVE-2026-95127?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** Libass 0.17.5.

**Is there a fix for CVE-2026-95127?** A patch was published on 2026: Fix available in GitHub PR #955 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95127 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95127?** Check whether you run Libass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A signed integer overflow (CWE-190) occurs in the ass_outline_construct() function when processing attacker-controlled subtitle parameters such as script resolution, font size, margins, or layout values. The bounding-box subtraction (bbox.x_max - bbox.x_min or bbox.y_max - bbox.y_min) overflows a signed 32-bit integer, causing undefined behavior and a crash. The vulnerability is reachable remotely through normal subtitle rendering without requiring special preconditions.

## Affected products

- libass libass 0.17.5

## Timeline

- 2026-10-10: disclosed: GitHub issue #947 disclosed
- 2026-10-13: advisory: NVD published
- 2026: patched: Fix available in GitHub PR #955

## References

- [https://gist.github.com/1820893135-pixel/5aee1e778240351c744ce5496eef3285](https://gist.github.com/1820893135-pixel/5aee1e778240351c744ce5496eef3285)
- [https://github.com/libass/libass/issues/947](https://github.com/libass/libass/issues/947)

## Related threats

- [libass out-of-bounds read and write in wrap_lines_measure](https://junglewise.ai/threats/cve-2026-61627-libass-is-a-portable-subtitle-renderer-for-the-ass-ssa-advanced)
- [libass memory corruption via negative Matroska ReadOrder](https://junglewise.ai/threats/cve-2026-61626-libass-is-a-portable-subtitle-renderer-for-the-ass-ssa-advanced)