{"id":"CVE-2026-119738","title":"Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()","summary":"The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network att…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-835"],"vendor":"Nexbox","product":"A95X","affected":["A95X NEXBOX-A95X-AP6330","android_sdk all versions"],"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T19:46:51.695Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119738","references":[{"url":"https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","label":"Researcher Disclosure"},{"url":"https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu","label":"VulnCheck Advisory: Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()"}],"tags":["cve.org"],"epss":0.00289,"epssPercentile":0.21605,"ingestedAt":"2026-11-05T19:30:42.810Z","slug":"CVE-2026-119738","body":"## Overview\n\nThe VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.\n\n## Affected\n\n- `A95X NEXBOX-A95X-AP6330`\n- `android_sdk all versions`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}