CVE-2026-119739: Medium severity vulnerability

The VobSub subtitle decoder libsubvob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vobfillpixel() that allows remote attackers to corrupt stack memory by sending a crafted SETCONTR command with an attacker-controlled alpha value that drives an unbounded array index (changedata) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.