CVE-2026-119739— Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR

Quick assessment

Affected

Nexbox A95X

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Nexbox A95X（搭载 Amlogic S905X 芯片）电视盒子上预装的 VobSub 字幕解码器 libsub_vob（属于 Amlogic DroidLogic SubTitleService 组件）中存在一个越界写入漏洞。该漏洞位于 vob_fill_pixel() 函数中：攻击者可构造一条 SET_CONTR 命令，通过控制其中的 alpha 值，使未受限制的下标（change_data）超出固定长度为 4 的 PixelDatas 数组边界，从而向栈内存写入非法数据。攻击者可通过未认证的 TC

CVSS 5.3 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1569 · System Services T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR

Source: CVE Program / CVE List V5

Vulnerability Description

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Nexbox	A95X	NEXBOX-A95X-AP6330	-
Amlogic	Amlogic Android SDK	0	-

II. Public POCs for CVE-2026-119739

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119739

请登录查看更多情报信息。

Other References for CVE-2026-119739 (2)

https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html technical-description exploit
https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-out-of-bounds-write-via-vobsub-set-contr third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119739

Same Patch Batch · Nexbox · 2026-11-02 · 4 CVEs total

CVE-2026-119737	7.8 HIGH	Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
CVE-2026-119740	6.8 MEDIUM	Nexbox A95X Amlogic S905X UART Unauthenticated Console Access
CVE-2026-119738	5.3 MEDIUM	Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()

IV. Related Vulnerabilities

Same product: A95X

Same vendor: Nexbox

Same weakness: CWE-787