Out-of-Bounds Write in Amlogic DroidLogic SubTitleService on Nexbox A95X TV Boxes

CVE-2026-119739

What is CVE-2026-119739?

The Amlogic DroidLogic SubTitleService is susceptible to an out-of-bounds write vulnerability within the vob_fill_pixel() function, leading to potential remote exploitation. By sending a specifically crafted SET_CONTR command that manipulates the alpha value, an attacker can exploit this flaw to write past the intended memory boundaries of the fixed PixelDatas array. This issue allows unauthorized access to modify stack memory and can lead to silent corruption or crashes of running processes. Attack vectors include sending malicious VobSub data over an unauthenticated TCP socket (port 10100) or through a crafted .sub file.

References