Heap Out-of-Bounds Write Vulnerability in L-SMASH Affects Video Processing Applications
CVE-2026-120456

6.9MEDIUM

Key Information:

Vendor

L-smash

Status
L-smash
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120456?

L-SMASH versions up to 2.14.5 contain a vulnerability that allows for an out-of-bounds write in the functions isom_read_hdlr() and isom_read_dref_entry() found in core/read.c. This issue arises when attackers exploit oversized box sizes in crafted MP4 or MOV files, which declare hdlr or url box sizes that exceed the amount of remaining data. Such malicious files can stall the stream position and lead to corruption of heap memory, ultimately crashing the affected applications and compromising system stability.

Affected Version(s)

L-SMASH 0 <= 2.14.5

References

https://github.com/l-smash/l-smash/issues/112
issue-tracking
https://github.com/l-smash/l-smash/commit/805ee3c9632e054...
patch
https://github.com/l-smash/l-smash/blob/v2.14.5/core/read...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
Yusuke Nakamura
.