{"id":"CVE-2026-119738","kind":"vulnerability","aliases":["CVE-2026-119738"],"related":[],"title":"Nexbox A95X TV box: VobSub decoder loop lets crafted subtitles freeze playback","description":"The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.","summary":"The VobSub subtitle decoder shipped on Nexbox A95X (Amlogic S905X) TV boxes can enter an infinite loop when a length field mismatches. An attacker can cause the subtitle thread to use 100% CPU indefinitely, which is a denial of service.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amlogic","droidlogic","infrastructure","nexbox-a95x","tv-box"],"not_affected_if":["other-hardware","tcp-10100-blocked"],"how_to_check":"- Check whether the device is a Nexbox A95X (Amlogic S905X) TV box running the Amlogic DroidLogic SubTitleService.\n- Check whether tcp/10100 is reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:36:37+00:00","updated_at":"2026-11-02T20:36:37+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T20:36:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Nexbox A95X TV box: VobSub decoder loop lets crafted subtitles freeze playback","impact":"low","summary":"The VobSub subtitle decoder shipped on Nexbox A95X (Amlogic S905X) TV boxes can enter an infinite loop when a length field mismatches. An attacker can cause the subtitle thread to use 100% CPU indefinitely, which is a denial of service.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["nexbox-a95x","amlogic","tv-box","droidlogic"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Subtitle decode thread spins at 100% CPU, causing denial of service","analyst_note":"Confirm affected firmware versions and whether a vendor fix exists; source given is only NVD and a VulnCheck advisory.","how_to_check":"- Check whether the device is a Nexbox A95X (Amlogic S905X) TV box running the Amlogic DroidLogic SubTitleService.\n- Check whether tcp/10100 is reachable from untrusted networks.\n- unknown for a firmware version check: the sources do not give affected firmware versions.","plain_action":"If you own a Nexbox A95X TV box, check with the device maker for a firmware update that fixes the subtitle decoder; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["other-hardware","tcp-10100-blocked"],"who_is_affected":"Owners of Nexbox A95X (Amlogic S905X) TV boxes running the vulnerable VobSub decoder are affected. The unauthenticated tcp/10100 listener can be reached over the network, and a malicious .sub file loaded locally can also trigger it. Teams that do not run these boxes can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000774,"input_tokens":4287,"output_tokens":691,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119738':15A,18A '-2026':14A,17A '100':59B,148C 'a95x':2A,24B,35B,84C 'allow':99C 'amlog':19B,36B,77C,85C 'amlu':124C 'attack':51B,102C,120C 'block':126C 'box':4A,27B,39B,88C 'caus':53B,140C 'condit':115C 'contain':89C 'cpu':60B,149C 'craft':9A,123C 'cve':13A,16A 'data':125C 'decod':6A,31B,71C,143C 'denial':65B,153C 'droidlog':20B,78C 'enter':41B 'exit':114C 'field':48B,119C 'file':108C,138C 'freez':11A 'get':95C 'indefinit':61B,150C 'infinit':43B,91C 'infrastructur':21B 'length':47B,118C 'let':8A 'libsub':72C 'listen':131C 'load':106C 'local':104C 'loop':7A,44B,92C,113C 'malici':107C,135C 'mismatch':49B,117C 'network':101C 'nexbox':1A,23B,34B,83C 'nexbox-a95x':22B 'part':74C 'playback':12A 'result':151C 's905x':37B,86C 'send':122C 'servic':67B,155C 'ship':32B,81C 'spin':146C 'spu':97C 'sub':137C 'subtitl':10A,30B,55B,70C,142C 'subtitleservic':79C 'tcp/10100':130C 'thread':56B,144C 'trigger':110C 'tv':3A,26B,38B,87C 'tv-box':25B 'unauthent':100C,129C 'unreach':112C 'use':58B 'user':105C 'via':116C,133C 'vob':73C,96C 'vobsub':5A,29B,69C,136C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":"Owners of Nexbox A95X (Amlogic S905X) TV boxes running the vulnerable VobSub decoder are affected. The unauthenticated tcp/10100 listener can be reached over the network, and a malicious .sub file loaded locally can also trigger it. Teams that do not run these boxes can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Nexbox A95X TV box, check with the device maker for a firmware update that fixes the subtitle decoder; the sources do not name a fixed version.","pkeys":[],"ptokens":[],"labels":["amlogic","droidlogic","infrastructure","medium","nexboxa95x","tvbox"],"first_public_at":"2026-11-02T20:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119738","severity":null,"published_at":"2026-11-02T20:17:38+00:00","modified_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null}],"documents":[{"id":53706,"url":"https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}