CVE-2026-120456— L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes

Quick assessment

Affected

L-SMASH L-SMASH

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

L-SMASH 2.14.5 及更早版本在文件中的和函数存在堆越界写入漏洞。该漏洞由过大的盒子（box）尺寸触发。攻击者可构造声明的或盒子尺寸超过剩余数据长度的 MP4 或 MOV 文件，导致流位置停滞并破坏堆内存，进而引发应用程序崩溃。

CVSS 6.1 · Medium EPSS 0.16% · P5 Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
L-SMASH	L-SMASH	`≤ 2.14.5`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes

Source: CVE Program / CVE List V5

Vulnerability Description

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
L-SMASH	L-SMASH	0 ~ 2.14.5	-

II. Public POCs for CVE-2026-120456

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120456

请登录查看更多情报信息。

Other References for CVE-2026-120456 (6)

https://github.com/l-smash/l-smash/issues/112 issue-tracking
https://github.com/l-smash/l-smash/commit/805ee3c9632e054198d3cb5b09c7b7aa36cdd791 patch
https://hackmd.io/@haindpwn/lsmash-hdlr-dref-box-size-oob-write technical-description
https://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L688-L717 technical-description
https://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L853-L876 technical-description
https://www.vulncheck.com/advisories/l-smash-through-2.14.5-heap-out-of-bounds-write-via-hdlr-and-url-boxes third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120456

IV. Related Vulnerabilities

Same product: L-SMASH

Same vendor: L-SMASH

Same weakness: CWE-787