Read the docs
TI-2026-70169 Aliases CVE-2026-92705

Aegisub runs code from automatically loaded Automation scripts

Priority LOW 35CWE-158Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

Aegisub from 3.2.0 before 3.5.0 automatically loads Automation scripts referenced in ASS subtitle projects without asking whether the user trusts them. The flaw is classified as CWE-829, inclusion of functionality from an untrusted control sphere. An attacker who distributes a crafted ASS file with a malicious referenced script can run code with the privileges of the Aegisub process when a user opens the file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00128 2nd percentileScored 2026-11-07
Fix Fixed Aegisub (TypesettingTools): 3.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TypesettingToolsAegisub3.2.0 to before 3.5.03.5.0Patch availableCNA
  • Aegisub VendorTypesettingTools Affected 3.2.0 to before 3.5.0 Fixed in 3.5.0 Patch available CNA

Remediation

Upgrade Aegisub to version 3.5.0, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Aegisub (TypesettingTools) Fixed in 3.5.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-92705
  2. 2026-10-11 Priority changed: MEDIUM → LOW
  3. 2026-10-13 Affected versions changed · Red Hat
  4. 2026-10-13 CVSS score added · Red Hat
  5. 2026-10-14 CISA SSVC decision points changed

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences