CVE-2026-119738

The record

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-835
• CVE-2026-121261 A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. CWE-835
• CVE-2026-121400 FreeRDP before 3.32.2 contains a denial-of-service vulnerability in… CWE-835
• CVE-2026-120596 A remotely exploitable denial-of-service vulnerability exists in the TCP options parser… CWE-835
• CVE-2026-120458 Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in… CWE-835
• CVE-2026-120251 imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in… CWE-835
• CVE-2026-120194 A flaw was found in json-glib. CWE-835
• CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-835