CVE-2016-20099

Deferred Deferred - Pending Action

L-SMASH Infinite Loop via Zero-Byte File

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c that allows attackers to hang applications via crafted input files. Attackers can supply a file consisting only of zero bytes, which lsmash_read_file() probes automatically, causing indefinite CPU consumption and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2016-20099

EUVD

EUVD-2016-10915

Affected Vendors & Products

Vendor	Product	Version / Range
l-smash	l-smash	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

CVE-2016-20099 is an infinite loop vulnerability in L-SMASH through version 2.14.5. It occurs in the VC-1 importer probe function (vc1_importer_probe) in importer/vc1_imp.c. Attackers can exploit this by providing a file filled with zero bytes. When the application probes this file using lsmash_read_file, it triggers an infinite loop causing indefinite CPU usage and application hangs.

Detection Guidance

To detect this vulnerability, monitor applications using L-SMASH for abnormal CPU usage or hangs when processing media files. Check for files with all zero bytes or malformed VC-1/HEVC streams. Use tools like lsmash_read_file() with suspicious input files to observe infinite loops or crashes.

Impact Analysis

This vulnerability can cause denial of service by hanging applications or consuming excessive CPU resources. If exploited, it may disrupt services relying on L-SMASH for media processing, leading to unresponsive systems or crashes. The impact is higher on systems processing untrusted media files.

Compliance Impact

This vulnerability primarily causes denial of service through infinite loops or memory corruption, which could disrupt system availability. While not directly violating GDPR or HIPAA, such disruptions may impact data processing operations subject to these regulations, potentially leading to compliance issues if critical systems become unavailable.

Mitigation Strategies

Immediately update L-SMASH to the latest patched version if available. Avoid processing untrusted media files, especially those with all zero bytes or malformed VC-1/HEVC streams. Implement input validation to reject suspicious files before processing.

Hi! I’m here to help you understand CVE-2016-20099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70