CVE-2026-119738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119738", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T15:31:52.079Z", "datePublished": "2026-11-02T19:44:54.168Z", "dateUpdated": "2026-11-07T02:25:33.248Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T19:46:51.695Z"}, "title": "Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()", "descriptions": [{"lang": "en", "value": "The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service."}], "datePublic": "2026-10-29T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')", "cweId": "CWE-835", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "vendor": "Nexbox", "product": "A95X", "versions": [{"status": "affected", "version": "NEXBOX-A95X-AP6330", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "vendor": "Amlogic", "product": "Amlogic Android SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "references": [{"url": "https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html", "name": "Researcher Disclosure", "tags": ["technical-description", "exploit"]}, {"url": "https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu", "name": "VulnCheck Advisory: Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Matteo Strada (mstreet)", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-07T02:25:11.416687Z", "id": "CVE-2026-119738", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T02:25:33.248Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119738", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-07T02:25:11.416687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T02:25:29.251Z"}}], "cna": {"title": "Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()", "credits": [{"lang": "en", "type": "finder", "value": "Matteo Strada (mstreet)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Nexbox", "product": "A95X", "versions": [{"status": "affected", "version": "NEXBOX-A95X-AP6330", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Amlogic", "product": "Amlogic Android SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-29T00:00:00.000Z", "references": [{"url": "https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html", "name": "Researcher Disclosure", "tags": ["technical-description", "exploit"]}, {"url": "https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu", "name": "VulnCheck Advisory: Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T19:46:51.695Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119738", "state": "PUBLISHED", "dateUpdated": "2026-11-07T02:25:33.248Z", "dateReserved": "2026-10-30T15:31:52.079Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-02T19:44:54.168Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "A95X", "vendor": "Nexbox", "versions": [{"status": "affected", "version": "NEXBOX-A95X-AP6330", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Amlogic Android SDK", "vendor": "Amlogic", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service."}], "id": "CVE-2026-119738", "lastModified": "2026-11-07T03:17:02.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119738", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-07T02:25:11.416687Z", "version": "2.0.3"}}]}, "published": "2026-11-02T20:17:38.310", "references": [{"source": "disclosure@vulncheck.com", "url": "https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Amlogic Android SDK", "source": "cna", "vendor": "Amlogic"}, "product": "amlogic_android_sdk", "vendor": "amlogic"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "NEXBOX-A95X-AP6330"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "A95X", "source": "cna", "vendor": "Nexbox"}, "product": "a95x", "vendor": "nexbox"}], "created": "2026-11-02T22:00:06.912634+00:00", "updated": "2026-11-03T16:25:21.421529+00:00", "vendors": ["amlogic", "amlogic$PRODUCT$amlogic_android_sdk", "nexbox", "nexbox$PRODUCT$a95x"]}