{"action":"Upgrade libass to 1:0.17.3-1+deb13u1 or later.","affected":[{"fixed":"1:0.17.3-1+deb13u1","introduced":"0"}],"component":"libass","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1:0.17.3-1+deb13u1"],"id":"tcs_01M5NT7FWP90AHN8Y87EZDS9XZ","modified_at":"2026-10-31T06:00:09.740330051Z","published_at":"2026-10-30T15:16:52.650Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-61627","https://security-tracker.debian.org/tracker/CVE-2026-61627"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-61627#Debian:13/libass","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-61627"}],"summary":"libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines"}