Read the docs
TI-2026-83848 Aliases CVE-2026-120456GHSA-q7pj-x362-2v3p

Heap out-of-bounds write in L-SMASH via hdlr and url boxes

Priority LOW 30CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

L-SMASH through 2.14.5 contains a heap out-of-bounds write in isom_read_hdlr() and isom_read_dref_entry() that is triggered by oversized box sizes. An attacker can supply a crafted MP4 or MOV file that declares hdlr or url box sizes larger than the remaining data, which corrupts heap memory and crashes applications that parse the file.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
l-smashL-SMASHup to 2.14.5—No fix listedCNA
  • L-SMASH Vendorl-smash Affected up to 2.14.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for L-SMASH.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120456
  2. 2026-11-02 Alias added: GHSA-q7pj-x362-2v3p
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2026-74093 Double free in L-SMASH HEVC and H.264 importer probe CVSS 4.0MEDIUM 6.9
  • TI-2016-09370 Infinite loop in L-SMASH VC-1 importer probe allows denial of service CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences