Amlogic DroidLogic SubTitleService CVE-2026-119738

Two concrete trigger paths are documented. Network path: the attacker must be able to reach the DroidLogic SubTitleService's unauthenticated TCP listener on port 10100 and send a crafted AMLU data block containing mismatched length fields; no authentication or user interaction is required (PR:N/UI:N). Local path: a local user loads a malicious VobSub (.sub) file that is parsed by libsub_vob/get_vob_spu(). Limiting factors defenders should weigh: the device must be an Amlogic-based unit running the DroidLogic SubTitleService (e.g. Nexbox A95X / S905X firmware); the tcp/10100 listener is a local service typically reachable only on the LAN rather than the internet; and the impact is confined to a denial of service of the subtitle decode thread (100% CPU spin) with no data exposure or code execution.

The input CVSS 4.0 base score is 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and VA:L - a network-reachable, unauthenticated, low-complexity flaw whose only impact is a limited loss of availability (no confidentiality or integrity effect). This is consistent with CWE-835: an infinite loop that pins the subtitle decode thread at 100% CPU rather than crashing or compromising the device. No EPSS probability and no CISA KEV status are present in the input, so widespread or automated exploitation cannot be asserted; the only exploit signal is a single PoC reference (a UART-to-root research write-up) that is not verified as working exploit code. The vendor/aggregator decision label is 'this_month', i.e. a scheduled-remediation priority rather than act_now or emergency. Worth noting the network/local tension: although AV:N is assigned because exploitation goes through a TCP listener, that listener (tcp/10100) is a local SubTitleService on a consumer Android TV box and in practice is reached over the LAN, not the public internet - verify exposure in the actual deployment before treating this as internet-facing. Net: a real but bounded DoS issue on a niche consumer product; genuinely medium, not a high-urgency network RCE, and the missing EPSS/KEV data means prioritization rests on the 'this_month' label and local-service reachability.

An attacker on the same network as a Nexbox A95X TV box connects to the unauthenticated SubTitleService listener on tcp/10100 and sends a crafted AMLU data block whose length fields are mismatched, driving get_vob_spu() into a loop whose exit condition is never reached. Alternatively, a local user opens a malicious VobSub (.sub) subtitle file, reaching the same code path. The subtitle decode thread then spins at 100% CPU indefinitely, denying subtitle/playback service; a public PoC reference exists but is not verified as working exploit code.