DroidLogic SubTitleService CVE-2026-119739

Exploitation requires that the Amlogic DroidLogic SubTitleService be reachable, either via its unauthenticated tcp/10100 control socket on the local network or by getting the device to parse an attacker-supplied VobSub .sub file. The concrete trigger is a SET_CONTR command whose attacker-controlled alpha value drives the change_data index beyond the fixed four-element PixelDatas array in vob_fill_pixel(). No authentication and no user interaction are required (PR:N/UI:N). Limiting factors: the tcp/10100 service is typically LAN-exposed rather than internet-facing by default, so an attacker generally needs local/adjacent network position or a delivery path for the malicious subtitle file; and the memory effect is confined to zeroing adjacent stack bytes, which limits realistic impact to silent corruption or a service crash rather than reliable control of execution.

This is a medium-severity, lower-real-risk issue despite being remotely triggerable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated triggering with no user interaction - consistent with the description's unauthenticated tcp/10100 socket. Crucially, impact is constrained to availability only (VC:N/VI:N/VA:L): the out-of-bounds write (CWE-787) zeros adjacent stack bytes, producing silent corruption or a process crash rather than demonstrated code execution or data disclosure, so the practical outcome is a denial of service of the SubTitleService. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the moderate 6.9 score. A public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV listing - so this is not confirmed active exploitation. EPSS is not provided in the input, so exploitation probability cannot be weighed; this absence should be noted rather than assumed low. Net: easy to trigger but limited blast radius on a niche consumer device, making this a routine-patch priority rather than an emergency.

An attacker with network access to an exposed Nexbox A95X box connects to the unauthenticated tcp/10100 socket (or gets the device to parse a malicious .sub file) and sends a crafted SET_CONTR command carrying an oversized alpha value. The alpha drives the change_data index past the fixed four-element PixelDatas array in vob_fill_pixel(), zeroing adjacent stack bytes and crashing or silently corrupting the SubTitleService. A public PoC reference (a disclosure blog) exists but is not verified as working exploit code.