Infinite Loop Vulnerability in L-SMASH Affected by Crafted Input Files
CVE-2016-20099

6.8MEDIUM

Key Information:

Vendor

L-smash

Status
L-smash
Vendor
CVE Published:
14 October 2026

What is CVE-2016-20099?

L-SMASH versions up to 2.14.5 contain a vulnerability within the vc1_importer_probe function, allowing attackers to exploit the system by supplying specially crafted input files consisting solely of zero bytes. This prompts the lsmash_read_file function to probe indefinitely, resulting in excessive CPU consumption and potentially causing applications to hang. This issue poses significant risks in environments where L-SMASH is utilized, as it can interrupt service availability and impact system performance.

Affected Version(s)

l-smash 0 <= 2.14.5

References

https://github.com/l-smash/l-smash/pull/58
patchissue-tracking
https://github.com/l-smash/l-smash/blob/v2.14.5/importer/...
technical-description
https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double...
third-party-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

canbal
HaiND from the Post and Telecommunication Institute of Technology
.