CVE-2026-110599
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
Risk Assessment
Processing a malicious media file can lead to memory corruption and potential code execution in the context of the application processing the file. This can result in system compromise or service crash.
Recommendation
Update L-SMASH to a version later than 2.14.5. Avoid processing untrusted media files until the fix is deployed.
Other vulnerabilities in L-SMASH
See all- CVE-2026-120456Medium
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data stall the stream position and corrupt heap memory.
- CVE-2016-20099Medium
L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c. Attackers can supply a file consisting only of zero bytes, which lsmash_read_file() probes automatically, causing indefinite CPU consumption and denial of service.
Original NVD description (English source)
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS