CVE-2026-92705

HIGH 7.8

Aegisub executes arbitrary code through automatically loaded Automation scripts

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.

CWE	CWE-158 CWE-829
Vendor	typesettingtools
Product	aegisub
Published	Oct 9, 2026

Stay Ahead of the Next One

Get instant alerts for typesettingtools aegisub

Be the first to know when new high vulnerabilities affecting typesettingtools aegisub are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

TypesettingTools / Aegisub

>= 3.2.0, < 3.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23 github.com: https://github.com/TypesettingTools/Aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff github.com: https://github.com/TypesettingTools/Aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6 github.com: https://github.com/TypesettingTools/Aegisub/commit/e4099055711cce327840870c050ce46e58f4aee0