The vulnerability resides in the ass_outline_construct function of libass v0.17.5 and allows an attacker to craft a malicious subtitle file that, when processed, causes a crash. This crash terminates the host application and disrupts media playback. The defect is identified as CWE‑400, indicating uncontrolled resource consumption. The exact nature of the memory error is not detailed, but the failure to handle input data properly leads to denial of service.

Only libass release 0.17.5 is identified as affected. No other versions are referenced, so the impact is limited to this release.

An attacker can deliver a malicious subtitle to any system that loads libass 0.17.5, causing a denial of service. The CVSS score of 7.5 reflects high severity, while the EPSS score of less than 1 % and absence from the CISA KEV catalog indicate a low likelihood of exploitation. The attack vector is inferred to be the remote processing of the crafted subtitle file.