CVE-2026-92705
Description
A flaw was found in Aegisub. The application automatically loads and runs automation scripts referenced within Advanced SubStation Alpha (ASS) subtitle project files without prompting the user for confirmation. By tricking a user into opening a specially crafted subtitle file referencing a malicious script, an attacker can achieve arbitrary code execution with the permissions of the Aegisub process.
Statement
This flaw is rated Important because successful exploitation allows arbitrary code execution in the context of the running user whenever an untrusted project file is opened, although it requires user interaction rather than direct remote network access. Aegisub is a standalone graphical subtitle editor and is not included or supported in Red Hat Enterprise Linux, limiting exposure primarily to community Fedora environments where users manually install the desktop package. Because the vulnerability relies on convincing a local user to load a malicious subtitle script, server deployments and automated pipelines without interactive Aegisub sessions remain unaffected.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or permissions to the untrusted functionality, DOM-based XSS vulnerabilities, stealing user's cookies, open redirect to malware (CWE-601), etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
