LiveActive security incident?Get immediate response
CVE Record

CVE-2020-24994: Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attack...

Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-24994 is a stack overflow in libass, a subtitle parsing/rendering library. A crafted file can crash software using vulnerable libass versions, and the CVE record also lists possible remote code execution. Business risk depends on whether systems process untrusted subtitle or media files.

Executive priority

Prioritize remediation for products or services that accept external media or subtitle files. The issue has potential RCE impact, but the supplied evidence lacks CVSS scoring and active exploitation confirmation. Internal-only, trusted-file workflows are lower urgency but should still be updated.

Technical view

The issue is in parse_tag in libass/ass_parse.c before libass 0.15.0. The public CVE description says remote attackers may trigger denial of service or remote code execution with a crafted file. The source bundle provides no CVSS score, CWE, KEV status, or detailed exploit evidence.

Likely exposure

Exposure is most likely in applications or services that embed libass before 0.15.0 and parse ASS/SSA subtitle content from users, partners, downloads, or automated media pipelines. The bundle does not identify specific downstream products or packaged distributions.

Exploitation context

The vulnerability requires processing a crafted file through vulnerable libass parsing logic. KEV is false in the supplied bundle, and no cited source in the bundle establishes active exploitation. Treat public file-ingestion surfaces as higher concern than controlled internal-only processing.

Researcher notes

The strongest source-grounded facts are the affected component, function, version boundary, and crafted-file impact. Evidence is incomplete for exploit maturity, platform-specific impact, and downstream product exposure. Avoid assuming all media players are affected without confirming their libass version or vendor patch status.

Mitigation direction

  • Upgrade libass to 0.15.0 or later where available.
  • Check vendor guidance for downstream applications bundling libass.
  • Restrict untrusted subtitle and media file ingestion until remediated.
  • Run media parsing components with sandboxing and least privilege.
  • Prioritize internet-facing or user-upload processing paths first.

Validation and detection

  • Inventory systems and applications that include libass.
  • Confirm deployed libass versions are not before 0.15.0.
  • Identify workflows that parse ASS or SSA subtitle files.
  • Check whether downstream vendors backported the referenced fix.
  • Review crash reports around subtitle parsing for suspicious patterns.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-24994 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.