CVE-2026-52167 in LC32D1320
Summary
by MITRE • 10/15/2026
A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical stack-based buffer overflow located within the gensub_ParsePsb() function, which is part of the software implementation for AOC LC32D1320 v2.05 televisions or display devices. This specific component is responsible for parsing subtitle files in the .PSB format, a proprietary or specialized container often used for displaying text overlays on video content. The root cause of this flaw lies in insufficient boundary checking during the processing of input data provided by an attacker-controlled file. When the function processes a crafted .PSB subtitle file containing oversized or malformed payload data, it fails to validate the length of the incoming string against the size of the allocated stack buffer. This lack of validation allows external data to overwrite adjacent memory locations on the call stack, corrupting critical control flow information such as return addresses and saved frame pointers.
From a technical perspective, this vulnerability is classified under CWE-121, which denotes a stack-based buffer overflow. The exploitation mechanism relies on the precise manipulation of the input file to trigger an out-of-bounds write operation that overwrites the function's return address or other critical stack variables. In many embedded systems and consumer electronics like smart TVs, these devices often run lightweight operating systems with limited memory protection mechanisms compared to desktop environments. Consequently, when the corrupted return address is executed during the unwinding of the call stack, it typically results in a crash rather than arbitrary code execution due to strict memory segmentation or lack of executable stack permissions. However, the immediate and most reliable outcome of this flaw is a Denial of Service condition where the application handling the subtitle parsing crashes abruptly.
The operational impact of this vulnerability is significant for users who rely on the device's multimedia capabilities. An attacker can exploit this weakness by distributing malicious .PSB files through various vectors such as USB drives, network shares, or embedded within video streams if the player automatically attempts to load associated subtitles. Upon loading a crafted file, the application will terminate unexpectedly, leading to service disruption for the end-user. In the context of public displays or kiosk deployments using this hardware, an attacker could repeatedly trigger these crashes to render the display inoperable, causing substantial downtime and requiring manual intervention to restart the system. While the primary impact is availability loss, the underlying memory corruption nature means that with further refinement and specific device configurations, it might potentially be leveraged for more severe attacks, although this requires deeper reverse engineering of the specific firmware build.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The most effective solution is to apply a vendor-provided software patch or firmware update that modifies the gensub_ParsePsb() function to include rigorous input validation. This includes implementing strict length checks before copying data into stack buffers, utilizing safe string handling functions that prevent overflow, and potentially increasing buffer sizes if feasible within memory constraints. For organizations deploying this hardware in critical environments, it is advisable to disable automatic subtitle loading from untrusted sources or restrict the file types accepted by the media player component until patches are available. Additionally, implementing network-level filtering or endpoint detection systems can help identify attempts to load malformed files, although direct exploitation via local storage remains a primary risk vector given the nature of the flaw.
This vulnerability aligns with MITRE ATT&CK techniques related to resource hijacking and denial of service through application crashes. Specifically, it reflects behaviors associated with exploiting software vulnerabilities for availability impact rather than confidentiality or integrity breaches in its current observed state. Security teams should monitor vendor advisories closely as AOC releases updates addressing this issue. Until patches are applied, administrators must treat all subtitle files from untrusted origins as potentially malicious and enforce strict file type restrictions within the media player settings to minimize the attack surface exposed by this buffer overflow condition.