---
id: "CVE-2026-119738"
kind: "vulnerability"
aliases: ["CVE-2026-119738"]
title: "Nexbox A95X TV box: VobSub decoder loop lets crafted subtitles freeze playback"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["amlogic", "droidlogic", "infrastructure", "nexbox-a95x", "tv-box"]
not_affected_if: ["other-hardware", "tcp-10100-blocked"]
published_at: "2026-11-02T20:17:38+00:00"
first_seen_at: "2026-11-02T20:35:26+00:00"
updated_at: "2026-11-02T20:36:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119738", "first_seen_at": "2026-11-02T20:35:26+00:00"}]
---

# Nexbox A95X TV box: VobSub decoder loop lets crafted subtitles freeze playback

The VobSub subtitle decoder shipped on Nexbox A95X (Amlogic S905X) TV boxes can enter an infinite loop when a length field mismatches. An attacker can cause the subtitle thread to use 100% CPU indefinitely, which is a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the device is a Nexbox A95X (Amlogic S905X) TV box running the Amlogic DroidLogic SubTitleService.
- Check whether tcp/10100 is reachable from untrusted networks.

## Timeline

- 2026-11-02T20:35:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119738

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu

## From the sources

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_