CVE-2026-119738— Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()

Quick assessment

Affected

Nexbox A95X

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nexbox A95X（搭载 Amlogic S905X 芯片）电视盒子中随附的 VobSub 字幕解码器 libsub_vob（属于 Amlogic DroidLogic SubTitleService 的一部分），其 get_vob_spu() 函数中存在一个无限循环漏洞。由于长度字段不匹配，该漏洞可导致循环退出条件无法被触发。未经认证的网络攻击者或加载恶意文件的本地用户，可通过未认证的 tcp/10100 监听服务发送特制的 AMLU 数据块，或通过恶意 VobSub（.sub）文件，致使字幕解码线程以 10

CVSS 5.3 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()

Source: CVE Program / CVE List V5

Vulnerability Description

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不可达退出条件的循环(无限循环)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Nexbox	A95X	NEXBOX-A95X-AP6330	-
Amlogic	Amlogic Android SDK	0	-

II. Public POCs for CVE-2026-119738

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119738

请登录查看更多情报信息。

Other References for CVE-2026-119738 (2)

https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html technical-description exploit
https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119738

Same Patch Batch · Nexbox · 2026-11-02 · 4 CVEs total

CVE-2026-119737	7.8 HIGH	Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
CVE-2026-119740	6.8 MEDIUM	Nexbox A95X Amlogic S905X UART Unauthenticated Console Access
CVE-2026-119739	5.3 MEDIUM	Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR

IV. Related Vulnerabilities

Same product: A95X

Same vendor: Nexbox

Same weakness: CWE-835