{"id":"CVE-2026-119739","title":"Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR","summary":"The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers t…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Nexbox","product":"A95X","affected":["A95X NEXBOX-A95X-AP6330","android_sdk all versions"],"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T19:46:38.599Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119739","references":[{"url":"https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","label":"Researcher Disclosure"},{"url":"https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-out-of-bounds-write-via-vobsub-set-contr","label":"VulnCheck Advisory: Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR"}],"tags":["cve.org"],"epss":0.00371,"epssPercentile":0.3117,"ingestedAt":"2026-11-05T19:30:42.810Z","slug":"CVE-2026-119739","body":"## Overview\n\nThe VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.\n\n## Affected\n\n- `A95X NEXBOX-A95X-AP6330`\n- `android_sdk all versions`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}