Infinite Loop Vulnerability in Amlogic DroidLogic SubTitleService for Nexbox A95X TV Boxes
CVE-2026-119738

6.9MEDIUM

Key Information:

Vendor

Nexbox

Status
A95x
Amlogic Android Sdk
Vendor
CVE Published:
2 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-119738?

The VobSub subtitle decoder within Amlogic's DroidLogic SubTitleService, utilized on Nexbox A95X TV boxes, is susceptible to an infinite loop vulnerability. This flaw, present in the get_vob_spu() function, can be exploited by unauthenticated network attackers or local users through the delivery of malicious files. By sending specially crafted AMLU data blocks over an unauthenticated TCP listener on port 10100 or via a malicious VobSub (.sub) file, attackers can provoke the subtitle decode thread to consume 100% of CPU resources without reaching a loop exit condition. This effectively leads to a denial of service, severely disrupting device functionality.

Affected Version(s)

A95X NEXBOX-A95X-AP6330

Amlogic Android SDK 0

References

https://mstreet97.github.io/security-research/vulnerabili...
technical-descriptionexploit
https://www.vulncheck.com/advisories/amlogic-droidlogic-s...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matteo Strada (mstreet)
.