The vulnerability is an out‑of‑bounds write in the VobSub subtitle decoder library (libsub_vob) used by the Amlogic DroidLogic SubTitleService. When the decoder processes a crafted SET_CONTR command, an attacker can supply an alpha value that causes the change_data index to exceed the bounds of a four‑element array, resulting in stack memory corruption. This corruption can silently alter the state of the process or trigger a crash, which in turn leads to denial of service.

Affected products include the Amlogic Android SDK and Nexbox A95X (Amlogic S905X) TV boxes that ship the DroidLogic SubTitleService. The problem exists in the libsub_vob component of the subtitle service. No specific version numbers are available in the CVE entry.

The CVSS score of 6.9 indicates a moderate risk. Because the exploit can be carried out remotely over the unauthenticated TCP port 10100 or via a malicious .sub file, any user with network access to the device can trigger the flaw. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale exploit activity has not been observed yet. Nonetheless, the lack of authentication and the ability to corrupt stack memory make the threat realistic, especially in environments where the subtitle service is enabled and network exposure is unrestrained.