CVE-2026-120456 json
L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes
published 7d ago modified 7d ago also EUVD-2026-115216
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.
Patch / fix
Is CVE-2026-120456 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7d ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- L-SMASH L-SMASH
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/l-smash/l-smash/commit/805ee3c9632e054198d3cb5b09c7b7aa36cdd791
patch
-
github.com
/l-smash/l-smash/issues/112
issue-tracking
-
github.com
/l-smash/l-smash/blob/v2.14.5/core/read.c#L688-L717
technical-description
-
github.com
/l-smash/l-smash/blob/v2.14.5/core/read.c#L853-L876
technical-description
-
hackmd.io
/@haindpwn/lsmash-hdlr-dref-box-size-oob-write
technical-description
-
vulncheck.com
/advisories/l-smash-through-2.14.5-heap-out-of-bounds-write-via-hdlr-and-url-boxes
third-party-advisory
Sources
- CVE List CVE-2026-120456
- NVD CVE-2026-120456
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.