CVE catalog

CVE-2026-92705

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.13% · Oct 27, 2026

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianaegisubsid3.4.2+ds-5vulnerable
Debianaegisubforky3.4.2+ds-5vulnerable
Debianaegisubtrixie3.2.2+dfsg-7.3vulnerable
Debianaegisubbookworm3.2.2+dfsg-7vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianaegisubsourcesid(unfixed)not yet assignedNot reported[1150511]
Debianaegisubsourceforky(unfixed)not yet assignedNot reported[1150511]
Debianaegisubsourcetrixie(unfixed)not yet assignedNot reported[1150511]
Debianaegisubsourcebookworm(unfixed)not yet assignedNot reported[1150511]

[Debian bug #1150511]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [aegisub]Affected

    Source package: [aegisub]

    Details (2)

    • 3.2.2+dfsg-7+b3 · amd64 · bookworm

      Affected

      nvd · aegisub · debian · bookworm; nvd · aegisub · debian · 12

    • 3.2.2+dfsg-7+b3 · arm64 · bookworm

      Affected

      nvd · aegisub · debian · bookworm; nvd · aegisub · debian · 12

  • [aegisub-l10n]Affected

    Source package: [aegisub]

    Details (2)

    • 3.2.2+dfsg-7 · all · bookworm

      Affected

      nvd · aegisub · debian · bookworm; nvd · aegisub · debian · 12

    • 3.2.2+dfsg-7 · all · bookworm

      Affected

      nvd · aegisub · debian · bookworm; nvd · aegisub · debian · 12

[Debian 13 (Trixie)]

  • [aegisub]Affected
    Details (2)

    • 3.2.2+dfsg-7.3 · amd64 · trixie

      Affected

      nvd · aegisub · debian · 13

    • 3.2.2+dfsg-7.3 · arm64 · trixie

      Affected

      nvd · aegisub · debian · 13

  • [aegisub-l10n]Affected

    Source package: [aegisub]

    Details (2)

    • 3.2.2+dfsg-7.3 · all · trixie

      Affected

      nvd · aegisub · debian · 13

    • 3.2.2+dfsg-7.3 · all · trixie

      Affected

      nvd · aegisub · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]