- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 6
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 5 excluded.
Web 1
- https://github.com/libass/libass
Products and areas 10
- Font selection and embedded font handling, covering the fontconfig, CoreText and DirectWrite backends and the fonts a script can carry inside itself
- libass publishes no written policy. GitHub private vulnerability reporting is enabled on libass/libass and the project ships advisories through it, and nothing anywhere narrows scope below the library itself
- Line breaking, text measurement and layout, the area both June 2026 advisories touched
- Text shaping and the interaction with the shaper, including bidirectional text and complex script handling
- The ASS and SSA script parser end to end: the script info headers, the style definitions, the event lines and the timing fields
- The bitmap cache, blending and blur paths, and the rasteriser including its SIMD kernels
- The container-fed path where subtitles arrive as packets rather than as a file, including the Matroska ReadOrder handling
- The override tag grammar inside dialogue lines, which is a small programming language embedded in a text file and is where the parser does most of its work
- The public API and how it behaves on truncated, oversized or repeatedly appended input
- The vector drawing and clip command handling, where coordinate lists come straight out of the script
Out of scope (5)
- Bugs in HarfBuzz, FreeType or fontconfig, which libass calls but does not own
- Bugs in the player embedding libass rather than in the library
- Distribution packaging and vendored copies that have drifted from upstream
- libass publishes no exclusion list. The items below are genuinely another project's code rather than policy text
- Rendering and appearance defects with no memory-safety or disclosure consequence
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report through GitHub private vulnerability reporting on libass/libass.
-
Attach the subtitle script that triggers it plus the font set, since font selection and shaping change which code path runs
-
Say how the subtitles reached the library: a standalone .ass file, a track muxed into Matroska, or codec-private data.
-
Name the player you reproduced in, then show it against libass alone.
-
hold the detail until the advisory is live
Not accepted
-
Rendering and appearance defects with no memory-safety or disclosure consequence
-
Bugs in HarfBuzz, FreeType or fontconfig, which libass calls but does not own
-
Bugs in the player embedding libass rather than in the library
-
Distribution packaging and vendored copies that have drifted from upstream
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 6 CVEs, 2 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months 6 Lifetime Memory safety 55 % Parsing/validation 25 % Denial of service 15 % Info disclosure 5 % Latest advisories Loading the feed Overview libass renders ASS and SSA subtitles for essentially every player that exists. FFmpeg, VLC, mpv, Plex, Jellyfin and Kodi all draw their subtitles through it. Subtitle files travel separately from video and get downloaded from wherever, so libass parses attacker-chosen input as a matter of routine. That is the shape the 2017 subtitle attacks used, and it still holds: CVE-2026-61626, published in June 2026, is an out-of-bounds bit clear reached through a negative Matroska ReadOrder value. The project runs real coordinated disclosure and ships advisories that land, with no money attached at any point. sorona.xyz pays you directly on qualified, reproduced findings. In scope libass publishes no written policy. GitHub private vulnerability reporting is enabled on libass/libass and the project ships advisories through it, and nothing anywhere narrows scope below the library itself The ASS and SSA script parser end to end: the script info headers, the style definitions, the event lines and the timing fields The override tag grammar inside dialogue lines, which is a small programming language embedded in a text file and is where the parser does most of its work The vector drawing and clip command handling, where coordinate lists come straight out of the script Line breaking, text measurement and layout, the area both June 2026 advisories touched Text shaping and the interaction with the shaper, including bidirectional text and complex script handling Font selection and embedded font handling, covering the fontconfig, CoreText and DirectWrite backends and the fonts a script can carry inside itself The bitmap cache, blending and blur paths, and the rasteriser including its SIMD kernels The public API and how it behaves on truncated, oversized or repeatedly appended input The container-fed path where subtitles arrive as packets rather than as a file, including the Matroska ReadOrder handling Out of scope libass publishes no exclusion list. The items below are genuinely another project's code rather than policy text Bugs in HarfBuzz, FreeType or fontconfig, which libass calls but does not own Bugs in the player embedding libass rather than in the library Rendering and appearance defects with no memory-safety or disclosure consequence Distribution packaging and vendored copies that have drifted from upstream Most-valued findings Out-of-bounds reads and writes reached from a crafted script. Both live advisories are exactly this, and it is the class the whole record consists of Signed and negative values taken from container fields, the CVE-2026-61626 shape, where a negative Matroska ReadOrder reached a bit clear. Container-supplied integers get less validation than script text Anything in line breaking and text measurement, where CVE-2026-61627 landed. Measurement code runs on every line and gets almost no security attention The override tag and drawing command parsers, the densest attacker-controlled grammar in the library Embedded font handling, since a script can carry its own font and hand libass a second parser's worth of input Anything reachable from a subtitle file alone, with no cooperating video. That is the delivery vehicle in practice, and it is the reason a subtitle bug reaches a machine that never downloaded a hostile video Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on libass/libass. It is enabled and it is the channel the project actually uses There is no SECURITY.md, no security alias and no published timeline, so there are no stated terms to accept and none to hold anyone to Attach the subtitle script that triggers it plus the font set, since font selection and shaping change which code path runs Say how the subtitles reached the library: a standalone .ass file, a track muxed into Matroska, or codec-private data. The Matroska path carries container fields that the standalone path does not, and that is where CVE-2026-61626 lived Name the player you reproduced in, then show it against libass alone. Reports that only reproduce inside mpv or VLC get bounced upstream and back There is no reward here of any kind Disclosure Coordinated privately on GitHub and published as a GitHub Security Advisory alongside a fixed release, which is a process the project demonstrably runs rather than one it merely documents. Two advisories went out together in June 2026, so expect batching rather than one advisory per fix. No embargo length is published; hold the detail until the advisory is live, and account for the long tail of players that vendor libass and update it slowly. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability