ANT-2026-9WB9SMM6 · libass/libass

heap-buffer-overflow high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-9WB9SMM6: Heap-buffer-overflow in wrap_lines_measure at ass_render.c:1902 via malformed ASS/SSA subtitle

OSS-Fuzz discovered a heap-buffer-overflow (ASAN READ) in libass, the ASS/SSA subtitle renderer embedded in mpv, VLC, and FFmpeg-based players. The bug is an out-of-bounds read on heap memory triggered when parsing malformed subtitle data. An attacker who delivers a crafted subtitle file alongside media content can cause a crash or potentially leak heap memory contents. The specific crashing function and root cause are not identified in this report — no stack trace or affected code location was provided.

Target

Project: libass
Location: wrap_lines_measure() at libass/ass_render.c:1902

Technical Details

ASAN reports a READ crash (heap-buffer-overflow) with no size or address details provided. The root cause is not pinpointed — the report lacks the crash trace and function name. It may be related to the CVE-2020-36430 decode_chars() integer-subtraction bug (fixed in 0.15.1) or may be a distinct novel issue depending on the target version.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 4264302108
INFO: Loaded 1 modules   (55507 inline 8-bit counters): 55507 [0x5eeae80e8038, 0x5eeae80f590b), 
INFO: Loaded 1 PC tables (55507 PCs): 55507 [0x5eeae80f5910,0x5eeae81ce640), 
/out/libass_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1


=== ASAN Report ===
=================================================================
==27==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7486d9f71878 at pc 0x5eeae7ab4023 bp 0x7ffca0db89d0 sp 0x7ffca0db89c8
READ of size 4 at 0x7486d9f71878 thread T0
    #0 0x5eeae7ab4022 in wrap_lines_measure /src/libass/libass/ass_render.c:1902:50
    #1 0x5eeae7ab4022 in wrap_lines_smart /src/libass/libass/ass_render.c:1958:5
    #2 0x5eeae7ab4022 in ass_render_event /src/libass/libass/ass_render.c:2883:5
    #3 0x5eeae7aab505 in ass_render_frame /src/libass/libass/ass_render.c:3399:17
    #4 0x5eeae7a946d8 in consume_track /src/libass/fuzz/fuzz.c:163:23
    #5 0x5eeae7a946d8 in LLVMFuzzerTestOneInput /src/libass/fuzz/fuzz.c:425:9
    #6 0x5eeae7931b9d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #7 0x5eeae791c912 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    [... 16 more frames — full trace in crash.log]

Reproduction

Craft a malicious ASS/SSA subtitle file
Deliver it alongside or embedded within media content (e.g., MKV container)
Victim opens the media in a player using libass (mpv, VLC, etc.)
Heap-buffer-overflow triggers during subtitle parsing

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-9WB9SMM6.

Reference: ANT-2026-9WB9SMM6
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict: true positive
Severity: high

UPSTREAM FIX

The change that resolved this finding.

diff --git a/libass/ass_render.c b/libass/ass_render.c
index b10d5e241..e7ea7314a 100644
--- a/libass/ass_render.c
+++ b/libass/ass_render.c
@@ -1886,13 +1886,21 @@ wrap_lines_measure(RenderContext *state, char *unibrks)
 
     while (i < text_info->length && text_info->glyphs[i].skip)
         ++i;
+
+    if (i == text_info->length) {
+        text_info->lines[0].len = 0;
+        text_info->lines[0].offset = 0;
+        return;
+    }
+
     double pen_shift_x = d6_to_double(-text_info->glyphs[i].pos.x);
     double pen_shift_y = 0.;
 
     for (i = 0; i < text_info->length; ++i) {
         GlyphInfo *cur = text_info->glyphs + i;
+
         if (cur->linebreak) {
-            while (i < text_info->length && cur->skip && !FORCEBREAK(cur->symbol, i))
+            while (i < text_info->length - 1 && cur->skip && !FORCEBREAK(cur->symbol, i))
                 cur = text_info->glyphs + ++i;
             double height =
                 text_info->lines[cur_line - 1].desc +

https://github.com/libass/libass/commit/f2ef59755292bc4bb950ef22710e18a5487c399d

TIMELINE

Dates from discovery through public reveal.

2026-03-20 Reported to tracker
2026-05-13 Sent to maintainer
2026-05-13 Maintainer acknowledged
2026-06-23 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

b30eb2f05b830a169503a3765c0555ccd9d372c80abf92ee9ee6dbed3123cf115f25403726ac9bf34bc7449bf9c55d8e7d994e6a99a2b3d73d54e087c8850536

Committed 2026-05-13 10:55 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-9WB9SMM6",
  "bug_class": "heap-buffer-overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-20T19:13:31+00:00",
  "description": "OSS-Fuzz discovered a heap-buffer-overflow (ASAN READ) in libass, the ASS/SSA subtitle renderer embedded in mpv, VLC, and FFmpeg-based players. The bug is an out-of-bounds read on heap memory triggered when parsing malformed subtitle data. An attacker who delivers a crafted subtitle file alongside media content can cause a crash or potentially leak heap memory contents. The specific crashing function and root cause are not identified in this report — no stack trace or affected code location was provided.",
  "discovered_at": null,
  "location": "wrap_lines_measure() at libass/ass_render.c:1902",
  "poc_sha256": "f2a97f5480f0f390f4e5df3100ffa01c057e55cdf514767c586dc4c265882e8b",
  "preimage_version": 1,
  "project": "libass",
  "reproduction": [
    "Craft a malicious ASS/SSA subtitle file",
    "Deliver it alongside or embedded within media content (e.g., MKV container)",
    "Victim opens the media in a player using libass (mpv, VLC, etc.)",
    "Heap-buffer-overflow triggers during subtitle parsing"
  ],
  "technical_details": "ASAN reports a READ crash (heap-buffer-overflow) with no size or address details provided. The root cause is not pinpointed — the report lacks the crash trace and function name. It may be related to the CVE-2020-36430 decode_chars() integer-subtraction bug (fixed in 0.15.1) or may be a distinct novel issue depending on the target version.",
  "title": "Heap-buffer-overflow in wrap_lines_measure at ass_render.c:1902 via malformed ASS/SSA subtitle",
  "vendor_severity": "high"
}