Double Free Vulnerability in L-SMASH HEVC and H.264 Importer
CVE-2026-110599

6.9MEDIUM

Key Information:

Vendor

L-smash

Status
L-smash
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110599?

L-SMASH version 2.14.5 contains a vulnerability that leads to a double free condition in the HEVC and H.264 importer functionalities. This occurs within the methods hevc_setup_first_summary() and h264_setup_first_summary() in the source file importer/nalu_imp.c. Attackers can exploit this vulnerability by sending a specially crafted Annex-B elementary stream that omits a parseable Sequence Parameter Set (SPS) to the lsmash_read_file() function or various tools like boxdumper, remuxer, or muxer. The resulting improper handling of memory can trigger a use-after-free scenario, leading to heap corruption and application crashes, which may enable further exploitation or denial of service.

Affected Version(s)

l-smash 0 <= 2.14.5

References

https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double...
third-party-advisory
https://github.com/l-smash/l-smash/blob/v2.14.5/importer/...
technical-description
https://github.com/l-smash/l-smash/blob/v2.14.5/importer/...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.