CVE-2026-119738 in A95X
Summary
by MITRE • 11/02/2026
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within the libsub_vob component of the Amlogic DroidLogic SubTitleService represents a critical resource exhaustion flaw that impacts devices such as the Nexbox A95X TV box equipped with the Amlogic S905X processor. This specific implementation detail highlights how embedded systems, particularly those running Android-based firmware for consumer electronics like smart TVs and media players, often contain legacy or poorly maintained code paths that are exposed to external inputs without sufficient validation. The core of the issue resides in the get_vob_spu() function, which is responsible for parsing VobSub subtitle files. These files typically consist of a header followed by image data blocks encoded in AMLU format. When processing these structures, the decoder relies on length fields contained within the file to determine how much data to read and process. However, due to insufficient validation logic, an attacker can craft input where these length fields are mismatched or manipulated such that the loop condition governing the parsing of subtitle blocks never evaluates to false. This results in an infinite loop where the execution thread remains trapped in a continuous processing state without ever reaching a termination point.
From a technical perspective, this flaw is classified as CWE-835: Loop with Unreachable Exit Condition, which falls under the broader category of CWE-674: Uncontrolled Resource Consumption within the Common Weakness Enumeration framework. The operational impact of this vulnerability is severe in terms of availability, leading directly to a Denial of Service condition. Because the subtitle decoding thread spins at one hundred percent CPU utilization indefinitely, it consumes all available processing resources allocated to that core or thread pool. In an embedded environment like a TV box where system stability and responsiveness are paramount for user experience, this resource hogging can cause the entire device to become unresponsive. Users may find themselves unable to navigate menus, change channels, or interact with any other application running on the device until the power is cycled manually. This effectively renders the hardware useless as a media consumption endpoint during the attack window.
The exploitability of this vulnerability extends beyond local file execution, posing a significant risk via network vectors. The Amlogic DroidLogic SubTitleService includes an unauthenticated listener on TCP port 10100. Attackers who are able to reach this service over the network can send crafted AMLU data blocks directly to this endpoint without needing any form of authentication or prior access privileges. This lack of access control means that even devices connected to public networks or poorly segmented home networks are susceptible to remote exploitation. Furthermore, local users with file system access can also trigger the flaw by simply placing a maliciously constructed VobSub subtitle file in a directory monitored by the service for automatic loading. The dual vector of network-based and local file-based triggers significantly increases the attack surface and makes mitigation through simple user education difficult, as both remote attackers and potentially compromised local applications or scripts could initiate the exploit.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. For device manufacturers, a firmware update is required to patch the get_vob_spu() function by implementing strict bounds checking on all length fields before they are used in loop conditions. The parser should validate that the declared size of data blocks does not exceed buffer limits or file boundaries and must include explicit break statements or counter-based exit criteria to prevent infinite iteration. Additionally, input validation routines should be strengthened to reject malformed AMLU structures early in the parsing process rather than allowing them to enter deep processing loops. For network-facing services like the TCP 10100 listener, implementing authentication mechanisms is crucial to restrict access to trusted clients only. Furthermore, deploying rate limiting or connection timeouts on this service can help mitigate the impact of any remaining vulnerabilities by preventing sustained resource exhaustion attacks. System administrators and users should also consider isolating media devices from untrusted networks using network segmentation policies to reduce exposure to remote exploitation attempts until patches are applied.