CVE-2026-21088

Improper input validation in the subtitle frame loading process of libsubextractor.so prior to the SMR Sep-2026 Release 1 allows local attackers to exploit this vulnerability, potentially leading to out-of-bounds memory writes. This could result in application crashes or arbitrary code execution, making it critical for organizations using affected versions to prioritize patching. Local users with access to the system should be particularly vigilant, as they can leverage this flaw to escalate privileges or compromise system integrity.