Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-92705 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/TypesettingTools/Aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff	[email protected]	Source CodeVendor
https://github.com/TypesettingTools/Aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6	[email protected]	Source CodeVendor
https://github.com/TypesettingTools/Aegisub/commit/e4099055711cce327840870c050ce46e58f4aee0	[email protected]	Source CodeVendor
https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-158	Improper Neutralization of Null Byte or NUL Character	[email protected]
CWE-829	Inclusion of Functionality from Untrusted Control Sphere	[email protected]

Affected Products

Product	Versions
Aegisub	>= 3.2.0, <= 3.4.2 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 3.5.0moderate effort Workaround:low effort Do not open subtitle files or subtitle project bundles from untrusted sources. As a partial workaround, inspect an ASS file with a binary-safe text editor before opening it and remove all "Automation Scripts:" metadata lines. The editor must expose embedded NUL characters, which may otherwise be visually hidden.

Product

Versions

Aegisub

>= 3.2.0, <= 3.4.2 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 3.5.0moderate effort
Workaround:low effort
Do not open subtitle files or subtitle project bundles from untrusted sources. As a partial workaround, inspect an ASS file with a binary-safe text editor before opening it and remove all "Automation Scripts:" metadata lines. The editor must expose embedded NUL characters, which may otherwise be visually hidden.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 14, 2026	CVE Modified	CISA-ADP
Oct 9, 2026	New CVE Received	[email protected]