Live › vulnerability › CVE-2026-119738
The VobSub subtitle decoder shipped on Nexbox A95X (Amlogic S905X) TV boxes can enter an infinite loop when a length field mismatches. An attacker can cause the subtitle thread to use 100% CPU indefinitely, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Owners of Nexbox A95X (Amlogic S905X) TV boxes running the vulnerable VobSub decoder are affected. The unauthenticated tcp/10100 listener can be reached over the network, and a malicious .sub file loaded locally can also trigger it. Teams that do not run these boxes can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-119738")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.