CVE-2026-92705: CWE-158: Improper Neutralization of Null Byte or NUL Character in TypesettingTools Aegisub

CVE-2026-92705 affects Aegisub, a cross-platform subtitle editor, in versions 3.2.0 through 3.4.2. The software automatically loads Automation scripts referenced by metadata in ASS subtitle projects without user consent, enabling an attacker to execute arbitrary code by distributing a malicious ASS file with a referenced Automation script. Furthermore, versions 3.4.0 to 3.4.2 have inconsistent handling of embedded NUL characters between extension validation and filesystem operations, allowing a crafted ASS/Lua polyglot file to reference and execute itself as a single-file variant. The vulnerability is resolved in Aegisub 3.5.0.

Successful exploitation allows arbitrary code execution with the privileges of the Aegisub process upon opening a maliciously crafted subtitle file. This can lead to full compromise of the user environment under the context of the running application. The CVSS score of 7.8 indicates high severity with high impact on confidentiality, integrity, and availability.

Upgrade Aegisub to version 3.5.0 or later, where this vulnerability is fixed. Until then, users should avoid opening untrusted ASS subtitle files that may contain malicious Automation scripts. No official patch links were provided, but the vendor has addressed the issue in the stated fixed version.