CVE-2026-110599

Deferred Deferred - Pending Action

Double Free in L-SMASH via Annex-B Stream

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110599

EUVD

EUVD-2026-101227

Affected Vendors & Products

Vendor	Product	Version / Range
l-smash	l-smash	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

CVE-2026-110599 is a double free vulnerability in L-SMASH through version 2.14.5. It occurs in the HEVC and H.264 importer probe functions, specifically in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c. Attackers can exploit this by providing a crafted Annex-B elementary stream without a parseable SPS to lsmash_read_file() or tools like boxdumper, remuxer, or muxer. This leads to use-after-free, heap corruption, and crashes.

Detection Guidance

To detect this vulnerability, inspect systems running L-SMASH versions up to 2.14.5. Check for crashes or heap corruption when processing media files, particularly those with malformed Annex-B streams lacking SPS. Use tools like lsmash_read_file or the boxdumper, remuxer, or muxer tools with crafted input files to trigger potential issues.

Impact Analysis

This vulnerability can cause applications using L-SMASH to crash when processing untrusted media files. It may also lead to heap corruption or use-after-free issues, potentially allowing arbitrary code execution or denial of service if exploited. Users processing malicious H.264 or HEVC streams are at risk.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or potential code execution through crafted media files. GDPR requires data integrity and availability, while HIPAA mandates protection against unauthorized access or disruption of systems handling protected health information. Exploitation of this flaw may lead to system crashes or unauthorized processing of malicious files, violating these requirements.

Mitigation Strategies

Immediately update L-SMASH to a patched version beyond 2.14.5. If updating is not possible, avoid processing untrusted media files with L-SMASH tools. Implement input validation for media files to detect malformed streams. Monitor systems for crashes or heap corruption as potential indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-110599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70