CVE-2026-119739 Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119739?
CVE-2026-119739 is a medium-severity vulnerability in Amlogic A95X, published on 2 Nov 2026.
Official description
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.
Weakness: CWE-787
Which versions are affected by CVE-2026-119739?
How do I fix CVE-2026-119739?
No fix has been published for CVE-2026-119739 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119739 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119739 exists.
Sources
Also known as GHSA-mw5f-6hxf-hxw4.