---
id: CVE-2026-119739
title: Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR
summary: >-
  The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic
  SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains
  an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote
  attackers t…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-787
vendor: Nexbox
product: A95X
affected:
  - A95X NEXBOX-A95X-AP6330
  - android_sdk all versions
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:46:38.599Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119739'
references:
  - url: >-
      https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html
    label: Researcher Disclosure
  - url: >-
      https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-out-of-bounds-write-via-vobsub-set-contr
    label: >-
      VulnCheck Advisory: Amlogic DroidLogic SubTitleService Out-of-Bounds Write
      via VobSub SET_CONTR
tags:
  - cve.org
epss: 0.00371
epssPercentile: 0.3117
ingestedAt: '2026-11-05T19:30:42.810Z'
---

## Overview

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.

## Affected

- `A95X NEXBOX-A95X-AP6330`
- `android_sdk all versions`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.