The flaw arises when libass performs event pruning without guarding against negative Matroska ReadOrder values. An attacker can inject a malicious Matroska stream that, after being processed by ass_process_chunk with read‑order checking enabled, causes an out‑of‑bounds bit clear operation near a null pointer. The resulting memory corruption can terminate the process, causing a denial of service. The vulnerability is a classic example of an input validation failure leading to memory corruption (CWE‑787). The description does not indicate remote code execution or data disclosure; it is primarily a crash condition.

libass, the subtitle rendering component, is the affected product. Versions up to 0.17.4 contain the vulnerable pruning logic. The issue is resolved in release 0.17.5 and later. If your deployment uses libass 0.17.4 (or any earlier release that does not include the fix), it is susceptible to this flaw.

The CVSS score of 7.3 points to a high severity vulnerability. Exploitation requires the library to process a crafted Matroska stream, read‑order checking must remain enabled, and pruning must take place. The attack is most effective on systems that use a 32‑bit signed integer representation, support arithmetic right shifts, and have a kernel‑reserved upper address space. The resultant denial of service is the most likely consequence; further exploitation would be limited by address space layout and ASLR. Due to these conditions, the EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, indicating that widespread exploitation has not yet been observed.