CVE-2026-92705 TypesettingTools CVE debrief

Who should care

Users of Aegisub, particularly those who work with subtitle files, should assess their exposure to this vulnerability and take steps to mitigate it. This includes verifying the Aegisub version and reviewing Automation scripts for suspicious activity. Operators, platform administrators, and security teams should prioritize mitigation efforts.

Why it matters

This vulnerability allows for arbitrary code execution in Aegisub, a cross-platform advanced subtitle editor, through automatically loaded Automation scripts in ASS subtitle projects. Users of Aegisub should assess their exposure and take steps to mitigate the vulnerability.

• Arbitrary code execution with the privileges of the Aegisub process
• Potential for malicious Automation scripts to be executed
• Need for verification of Aegisub version and upgrade to 3.5.0 or later
• Importance of reviewing Automation scripts for suspicious activity

Technical summary

Aegisub, a cross-platform advanced subtitle editor, is vulnerable to arbitrary code execution through automatically loaded Automation scripts in ASS subtitle projects. The vulnerability exists from version 3.2.0 to 3.4.2 and is fixed in version 3.5.0. The vulnerability allows for arbitrary code execution with the privileges of the Aegisub process. A crafted ASS file with a referenced malicious Automation script can lead to execution of arbitrary code. Users of Aegisub should assess their exposure and take steps to mitigate the vulnerability.

Defensive priority

High

Recommended defensive actions

• Assess exposure of Aegisub installations to this vulnerability
• Verify Aegisub version and upgrade to 3.5.0 or later if necessary
• Review Automation scripts for suspicious activity
• Implement additional security measures to prevent exploitation
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the vulnerability in Aegisub. The vulnerability allows for arbitrary code execution through automatically loaded Automation scripts in ASS subtitle projects. Evidence is based on CVE Program records and supplemental source references. Defenders should verify Aegisub version and review Automation scripts for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.