CVE-2026-119739

The libsub_vob VobSub subtitle decoder, part of the Amlogic DroidLogic SubTitleService on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in the vob_fill_pixel() function. An attacker can provide a crafted SET_CONTR command with a malicious alpha value, causing...

CVE-2026-119739 Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR

The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an out-of-bounds write vulnerability in vobfillpixel that allows remote attackers to corrupt stack memory by sending a crafted SETCONTR command with an...

CVE-2026-119738 Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()

The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an infinite loop vulnerability in getvobspu that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachab...

CVE-2026-119738

The libsub_vob VobSub subtitle decoder, component of the Amlogic DroidLogic SubTitleService on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in the get_vob_spu() function. This issue is caused by mismatched length fields that trigger an unreachable loop exit condit...

CVE-2026-119738: Nexbox, Amlogic: The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X…

The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an infinite loop vulnerability in getvobspu that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachab...