A stack-based buffer overflow in the gensub_ParsePsb() function allows an attacker to crash the AOC LC32D1320 playback process by supplying a specially crafted .PSB subtitle file, resulting in a denial of service. The flaw is triggered when the application parses subtitle files, causing the stack to overflow and the process to terminate.

The unique vendor/product pair affected is AOC LC32D1320 version 2.05; no other vendors or products are listed as impacted.

The CVSS score of 6.2, combined with an EPSS score of < 1%, indicates a medium severity and a very low probability of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack requires an attacker to deliver or otherwise give the device a malicious .PSB subtitle file, so the likelihood of successful attack depends on how subtitle files are acquired and whether the device accepts them from untrusted sources. The primary risk is availability loss, as the crash halts playback until the device is restarted.