Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-119738Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()

Medium 5.3

In plain English

A medium-severity infinite loop in Amlogic Android SDK from Amlogic. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.

Affected products (as reported)

Vendor	Product	Versions
Nexbox	A95X	NEXBOX-A95X-AP6330
Amlogic	Amlogic Android SDK	0

Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Researcher Disclosure technical-description, exploit
VulnCheck Advisory: Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu() third-party-advisory