CVE-2026-119739 in A95X
Summary
by MITRE • 11/02/2026
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within the libsub_vob component of the Amlogic DroidLogic SubTitleService represents a critical memory safety flaw located specifically within the vob_fill_pixel function. This software module is integral to rendering subtitle overlays on devices powered by the Amlogic S905X SoC, such as the Nexbox A95X TV boxes. The core technical deficiency stems from an insufficient validation of input parameters before they are used as array indices. Specifically, when processing VobSub data, the system accepts a SET_CONTR command that includes an alpha value intended to control subtitle transparency or contrast. However, this alpha value is directly utilized without proper bounds checking to calculate an index into a fixed-size PixelDatas array, which contains only four elements. This design oversight allows an attacker who controls the input stream to specify an arbitrary integer for the alpha parameter, thereby driving the change_data variable beyond the allocated memory boundaries of the stack-allocated array.
From a technical perspective, this flaw is classified as an out-of-bounds write vulnerability, aligning with CWE-787 in the Common Weakness Enumeration taxonomy. The exploitation mechanism relies on the attacker sending malicious VobSub data through unauthenticated network services or by injecting crafted subtitle files into local storage. In many embedded media player implementations, port tcp/10100 is exposed for remote control or streaming purposes without requiring authentication. By connecting to this service and transmitting a specially constructed SET_CONTR command with an out-of-range alpha value, the attacker triggers the buffer overflow. The write operation proceeds past the end of the PixelDatas array, overwriting adjacent memory locations on the stack. This silent corruption can alter return addresses, function pointers, or other critical control data stored in nearby stack frames, leading to unpredictable behavior such as process crashes or potential code execution if the overwritten values are subsequently used by the application logic.
The operational impact of this vulnerability is significant for users relying on these devices for media consumption and smart TV functionalities. The immediate consequence is often a denial of service manifested through the crash of the SubTitleService, which may cause the entire system to become unstable or require a reboot. However, given that stack corruption can manipulate control flow, there exists a severe risk of remote code execution if an attacker can precisely craft the payload to overwrite specific return addresses with shellcode pointers. This aligns with ATT&CK technique T1203, which covers exploitation for client-side attacks, particularly in contexts where unauthenticated network services are present. The lack of authentication on port tcp/10100 exacerbates this risk by allowing any device on the local network to attempt exploitation without prior credentials.
Mitigation strategies must address both the immediate technical flaw and broader security posture. Developers should implement strict bounds checking within the vob_fill_pixel function to ensure that all array indices derived from input parameters remain within the valid range of zero to three for the PixelDatas array. Input validation logic must be added to reject or sanitize any alpha values that exceed expected limits before they are processed as memory offsets. For system administrators and users, immediate remediation involves disabling unnecessary network services if remote subtitle rendering is not required, thereby removing the attack surface associated with tcp/10100. Additionally, deploying stack canaries and enabling Address Space Layout Randomization (ASLR) where supported by the operating environment can mitigate the likelihood of successful exploitation even if the vulnerability persists in older firmware versions. Long-term resolution requires vendors to release patched firmware that incorporates these memory safety improvements and conducts rigorous static analysis testing on subtitle decoding libraries to prevent similar out-of-bounds access issues.