CVE-2026-119738 Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119738?
CVE-2026-119738 is a medium-severity vulnerability in Amlogic A95X, published on 2 Nov 2026.
Official description
The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.
Weakness: CWE-835
Which versions are affected by CVE-2026-119738?
How do I fix CVE-2026-119738?
No fix has been published for CVE-2026-119738 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119738 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119738 exists.
Sources
Also known as GHSA-wf2f-xx3j-mr34.