CVE-2026-110599: L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe
L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary() and h264setupfirstsummary() in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
Affected Software
Event History
Frequently Asked Questions
Which inputs and components are exposed?
The issue is triggered by a crafted Annex-B HEVC or H.264 elementary stream that lacks a parseable SPS. It affects callers of lsmash_read_file() and the boxdumper, remuxer, and muxer tools when they process such input.
What does an attacker need to do to exploit this?
An attacker needs to cause a user or application to process the crafted elementary stream. The reported vector is local and requires user interaction; no privileges are required.
What is the expected impact if exploitation succeeds?
The affected error paths can free borrowed codec-specific objects, resulting in use-after-free conditions, heap corruption, and crashes. The stated impact includes integrity and availability effects, while confidentiality is not indicated.
How can I tell whether a workflow may be affected?
A workflow may be affected if it uses L-SMASH through 2.14.5 to import or inspect untrusted Annex-B HEVC or H.264 elementary streams, particularly through lsmash_read_file(), boxdumper, remuxer, or muxer. Inputs missing a parseable SPS are the relevant trigger condition.