CVE-2026-119739 Details

An out-of-bounds write vulnerability has been identified in the VobSub subtitle decoder library (libsub_vob), which is part of the Amlogic DroidLogic SubTitleService. This vulnerability affects Nexbox A95X TV boxes running on the Amlogic S905X chipset, specifically those with the community build 'Aidan's ATV' and Android version 7.1.2. The issue arises in the 'vob_fill_pixel()' function, where an attacker can send a crafted SET_CONTR command with a manipulated alpha value. This exploitation drives an unbounded array index past the end of a fixed four-element array, allowing for remote stack memory corruption. The vulnerability can be exploited by sending malicious VobSub data over an unauthenticated TCP socket or through a harmful .sub file, leading to silent stack corruption or a process crash.

The vulnerability can be fixed by adding a bounds check to ensure that the array index does not exceed the limits of the PixelDatas array. Additionally, keeping the pppoe_wrapper socket away from untrusted user IDs or checking peer credentials could help mitigate the impact of the vulnerability.