{"id":"CVE-2026-119739","kind":"vulnerability","aliases":["CVE-2026-119739"],"related":[],"title":"Nexbox A95X TV boxes: VobSub subtitle decoder memory corruption flaw","description":"The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.","summary":"The VobSub subtitle decoder in Amlogic's SubTitleService, shipped on Nexbox A95X TV boxes, writes past the end of a fixed array when given crafted subtitle data. An attacker can corrupt stack memory or crash the process, either over an unauthenticated TCP socket on port 10100 or through a malicious .sub file.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amlogic","android","iot","nexbox-a95x","tv-box","vendor"],"not_affected_if":["no-subtitle-service","other-hardware","port-10100-blocked"],"how_to_check":"- Check whether the device is a Nexbox A95X (Amlogic S905X) TV box running the Amlogic DroidLogic SubTitleService.\n- Check whether TCP port `10100` is reachable from the network.\n- Check the firmware version on the device: unknown","fix":null,"status":"open","published_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:36:36+00:00","updated_at":"2026-11-02T20:36:36+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-02T20:36:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Nexbox A95X TV boxes: VobSub subtitle decoder memory corruption flaw","impact":"medium","summary":"The VobSub subtitle decoder in Amlogic's SubTitleService, shipped on Nexbox A95X TV boxes, writes past the end of a fixed array when given crafted subtitle data. An attacker can corrupt stack memory or crash the process, either over an unauthenticated TCP socket on port 10100 or through a malicious .sub file.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["nexbox-a95x","amlogic","tv-box","android","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker corrupts stack memory or crashes the subtitle process","analyst_note":"Find the vendor or VulnCheck advisory to confirm affected firmware versions and whether a fix exists.","how_to_check":"- Check whether the device is a Nexbox A95X (Amlogic S905X) TV box running the Amlogic DroidLogic SubTitleService.\n- Check whether TCP port `10100` is reachable from the network.\n- Check the firmware version on the device: unknown","plain_action":"If you own a Nexbox A95X TV box, ask the seller or manufacturer for a firmware update that fixes the subtitle decoder, and block the box's port 10100 from your network until then.","needs_analyst":true,"not_affected_if":["other-hardware","no-subtitle-service","port-10100-blocked"],"who_is_affected":"Owners of Nexbox A95X (Amlogic S905X) TV boxes running the Amlogic DroidLogic SubTitleService are exposed. The socket on tcp/10100 needs no authentication, and a malicious subtitle file played on the box is another path in. Devices of other brands or without this subtitle service are not described as affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000785,"input_tokens":4315,"output_tokens":706,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119739':13A,16A '-2026':12A,15A '10100':72B 'a95x':2A,22B,38B,95C 'adjac':176C 'allow':113C 'alpha':132C 'amlog':17B,32B,88C,96C 'android':18B 'array':48B,138C,152C 'attack':55B,115C,130C,153C 'attacker-control':129C 'bound':105C 'box':4A,25B,40B,99C 'byte':178C 'chang':140C 'command':126C 'contain':100C 'contr':125C 'control':131C 'corrupt':9A,57B,117C,183C 'craft':51B,123C 'crash':61B,186C 'cve':11A,14A 'data':53B,141C,161C 'decod':7A,30B,82C 'drive':135C 'droidlog':89C 'either':64B 'element':150C 'end':44B,144C 'exploit':155C 'file':78B,172C 'fill':110C 'fix':47B,147C 'flaw':10A 'four':149C 'four-el':148C 'given':50B 'index':139C 'iot':19B 'libsub':83C 'malici':76B,159C,170C 'memori':8A,59B,119C 'nexbox':1A,21B,37B,94C 'nexbox-a95x':20B 'out-of-bound':102C 'part':85C 'past':42B,142C 'pixel':111C 'pixeldata':151C 'port':71B 'process':63B,185C 'remot':114C 'result':179C 's905x':97C 'send':121C,158C 'set':124C 'ship':35B,92C 'silent':181C 'socket':69B,166C 'stack':58B,118C,177C,182C 'sub':77B,171C 'subtitl':6A,29B,52B,81C 'subtitleservic':34B,90C 'tcp':68B 'tcp/10100':165C 'tv':3A,24B,39B,98C 'tv-box':23B 'unauthent':67B,164C 'unbound':137C 'valu':133C 'vendor':26B 'via':168C 'vob':84C,109C 'vobsub':5A,28B,80C,160C 'vulner':107C 'write':41B,106C 'zero':174C","nicknames":[],"mitigations":[],"who_affected":"Owners of Nexbox A95X (Amlogic S905X) TV boxes running the Amlogic DroidLogic SubTitleService are exposed. The socket on tcp/10100 needs no authentication, and a malicious subtitle file played on the box is another path in. Devices of other brands or without this subtitle service are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Nexbox A95X TV box, ask the seller or manufacturer for a firmware update that fixes the subtitle decoder, and block the box's port 10100 from your network until then.","pkeys":[],"ptokens":[],"labels":["amlogic","android","iot","medium","nexboxa95x","tvbox","vendor"],"first_public_at":"2026-11-02T20:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119739","severity":null,"published_at":"2026-11-02T20:17:38+00:00","modified_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null}],"documents":[{"id":53708,"url":"https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-out-of-bounds-write-via-vobsub-set-contr","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}