EUVD-2026-102128
GHSA-jj7j-gp2j-7mc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted .PSB file via local media
-
ExploitDevice parses file in gensub_ParsePsb()
-
ExecutionStack buffer overflow corrupts stack
-
ImpactFirmware crashes, Denial of Service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to supply a crafted .PSB subtitle file that the AOC LC32D1320 (firmware v2.05) parses via its gensub_ParsePsb() function - concretely, getting the malicious subtitle file onto the device for processing (the CVSS Local vector, AV:L, rules out a remote network path and implies local delivery such as USB/removable media playback on the TV). Limiting factors: the attack is local-only (no remote exploitation), impact is confined to availability (A:H - a crash/DoS, not code execution or data compromise), and it is tied to this specific product and firmware version v2.05. No authentication is indicated (PR:N) and no user interaction is encoded in the provided vector (UI:N), though in practice the crafted file must still be loaded/played on the device. |
| Impact | This is a low-priority, medium-severity issue despite the CWE-121 stack overflow classification. The provided CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) is availability-only: the sole impact is a crash/Denial of Service, with no confidentiality or integrity impact and no code-execution claim in the description. Critically, the attack vector is Local (AV:L) - the attacker must supply a crafted .PSB subtitle file to the device for parsing (e.g., via USB/removable media on this AOC LCD TV), so there is no remote network path. EPSS corroborates low real-world risk at 0.17% (6th percentile), and the vuln.today decision label is 'this_month' - not 'act_now' or 'emergency'. There is NO CISA KEV listing, so this is not confirmed actively exploited. Public PoC references exist (a GitHub project 'libaoc' and a blog writeup) but are not verified as working weaponized exploit code. Net: a genuine but low-urgency DoS against a specific consumer TV model requiring local file delivery - the kind of high-CWE-label/low-real-risk issue that does not warrant emergency response. Note the input CPE and EUVD list vendor/product/version as 'n/a', so authoritative affected-product metadata is weak and the only concrete version anchor is 'v2.05' from the free-text description. |
| Exploit ScenarioDerived | An attacker crafts a malicious .PSB subtitle file and gets it onto the AOC LC32D1320 (v2.05) - for example on a USB stick played on the TV. When the firmware's gensub_ParsePsb() routine parses the file, the stack overflow crashes the device, causing a Denial of Service. A public PoC reference exists (GitHub 'libaoc' repo and a blog writeup) but is not verified as working exploit code; CVSS AV:L/AC:L means the trigger is local and low-complexity once the file is supplied. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A stack-based buffer overflow in the gensub_ParsePsb() subtitle parser of AOC LC32D1320 firmware v2.05 lets an attacker crash the display by supplying a crafted .PSB subtitle file. The vector is local (AV:L) with no privileges or user interaction required in the CVSS scoring (PR:N/UI:N), and impact is limited to availability (A:H) - a denial of service, not code execution or data exposure - giving a medium severity of 6.2. No CISA KEV entry exists and EPSS is minimal (0.17%, 6th percentile), so real-world exploitation is not confirmed; a public technical writeup and an associated libaoc code repository are linked, but working exploit code is not verified. Priority guidance places remediation in the this_month window rather than immediate action.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data, so AOC LC32D1320 owners should treat v2.05 as unpatched until AOC publishes updated firmware, and should monitor https://nvd.nist.gov/vuln/detail/CVE-2026-52167 and the researcher writeup at https://blog.facil.wtf/writeup-aoc-lc32d1320.html for a fix announcement. Because the assessed vector is local (AV:L) and the trigger is processing a malicious .PSB subtitle file, the practical compensating controls are analyst-derived rather than vendor-stated: do not load .PSB subtitle files from untrusted or unknown sources onto the display (playback of such a file is what reaches gensub_ParsePsb(), so avoiding untrusted subtitle files removes the exposure, at the cost of losing subtitles for that content), restrict physical/USB access to the TV to trusted users so removable media cannot be used as the delivery path, and prefer external playback devices for untrusted media. These reduce exposure but do not remove the underlying overflow, and the residual risk stays in place until firmware with a bounds-checked parser is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-121, a stack-based buffer overflow, occurring inside the gensub_ParsePsb() routine of the AOC LC32D1320 television firmware (v2.05), which handles .PSB subtitle files - the parsing path exercised when a subtitle track is loaded during media playback. The specific .PSB field or structure that overflows the stack buffer is not described in the available sources, so the precise trigger conditions beyond 'crafted .PSB file processed by this function' are unverified. Because the parser runs on the device itself, the CVSS AV:L metric reflects local delivery of the malicious file (for example via USB/removable media playback) rather than a network-reachable service; the supplied CPE string is unpopulated (n/a:n/a), so affected-product identification rests on the description and the third-party writeup rather than a formal NVD CPE mapping. The linked GitHub project (teogabrielofc/libaoc) and the blog.facil.wtf writeup appear to be reverse-engineering research on this firmware's subtitle handling, and ENISA EUVD-2026-102128 mirrors the same n/a version data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:L because the malicious .PSB file must be supplied locally to the device for parsing; AC:L and PR:N as no auth or special timing is described; impact is availability-only (A:H), so C:N/I:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB