CVE-2020-24994: Libass Project Libass

High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.

Affected products

• Libass Project Libass: before 0.15.0 (fixed in 0.15.0)

Published 2021-03-23. Last modified 2026-06-17.