Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-119739Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR

Medium 5.3

In plain English

A medium-severity out-of-bounds write in Amlogic Android SDK from Amlogic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.

Affected products (as reported)

Vendor	Product	Versions
Nexbox	A95X	NEXBOX-A95X-AP6330
Amlogic	Amlogic Android SDK	0

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Researcher Disclosure technical-description, exploit
VulnCheck Advisory: Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR third-party-advisory