Live › vulnerability › CVE-2026-119739
The VobSub subtitle decoder in Amlogic's SubTitleService, shipped on Nexbox A95X TV boxes, writes past the end of a fixed array when given crafted subtitle data. An attacker can corrupt stack memory or crash the process, either over an unauthenticated TCP socket on port 10100 or through a malicious .sub file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Owners of Nexbox A95X (Amlogic S905X) TV boxes running the Amlogic DroidLogic SubTitleService are exposed. The socket on tcp/10100 needs no authentication, and a malicious subtitle file played on the box is another path in. Devices of other brands or without this subtitle service are not described as affected.
No product ranges from the sources yet.
10100 is reachable from the network.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-119739")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.