← Vulnerability feed

Vulnerability record · CVE-2020-24994 · published 23 March 2021

CVE-2020-24994: Libass project libass allocation without limits vulnerability

LLibass Project · Libass

Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.

8.8 CVSS 3.1 High EPSS 2.7% · top 14.9% CWE-770 · Allocation without limits
8.8CVSS 3.1 base score, v2 6.8
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/libass/libass/commit/6835731c2fe4164a0c50bc91d12c43b2a2b4e PatchThird Party Advisory
https://github.com/libass/libass/issues/422 PatchThird Party Advisory
https://github.com/libass/libass/issues/422#issuecomment-806002919 Issue TrackingPatchThird Party Advisory
https://github.com/libass/libass/issues/423 Third Party Advisory
https://github.com/libass/libass/commit/6835731c2fe4164a0c50bc91d12c43b2a2b4e PatchThird Party Advisory
https://github.com/libass/libass/issues/422 PatchThird Party Advisory
https://github.com/libass/libass/issues/422#issuecomment-806002919 Issue TrackingPatchThird Party Advisory
https://github.com/libass/libass/issues/423 Third Party Advisory

Track CVE-2020-24994 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-26682Libass project libass integer overflow vulnerabilityIn libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow.EPSS 1.8%7.8CVE-2020-36430Libass project libass out-of-bounds write vulnerabilitylibass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer dat…EPSS 1.1%7.5CVE-2016-7969Opensuse leap out-of-bounds read vulnerabilityThe wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via u…EPSS 4.2%7.5CVE-2016-7970Fedoraproject fedora memory buffer overflow vulnerabilityBuffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unsp…EPSS 4.7%7.5CVE-2016-7972Opensuse leap vulnerabilityThe check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation…EPSS 5.2%8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2020-24994), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.