CVE-2026-52167 Details
Description
A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file.
A stack overflow vulnerability has been identified in the AOC LC32D1320 television, specifically in the media player's subtitle parsing function, gensub_ParsePsb(), in firmware version 2.05. This vulnerability allows attackers to cause a denial-of-service by supplying a crafted .PSB subtitle file. The issue arises because the subtitle parser copies text from the subtitle file into a fixed-size buffer without proper length validation. If the subtitle text is too long, it can overflow the buffer and overwrite adjacent stack memory, potentially leading to arbitrary code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.facil.wtf/writeup-aoc-lc32d1320.html | [email protected] | ExploitTechnical Analysis |
| https://github.com/teogabrielofc/libaoc | [email protected] | Source Code |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| AOC LC32D1320 | 2.05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |