CVE-2026-110599 in L-SMASH
Summary
by MITRE • 10/14/2026
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The L-SMASH project is an open-source multimedia framework widely utilized for processing various video formats, including High Efficiency Video Coding (HEVC) and Advanced Video Coding (AVC/H264). In versions up to 2.14.5, a critical memory management flaw exists within the NAL Unit importer module, specifically affecting the functions hevc_setup_first_summary() and h264_setup_first_summary(). These functions are responsible for initializing codec-specific data structures when parsing elementary streams. The vulnerability arises from improper handling of borrowed objects during error conditions, leading to a double free scenario that compromises memory integrity and application stability.
The technical root cause lies in the logic governing how codec-specific configuration objects are managed upon encountering malformed input. When lsmash_read_file() or related tools such as boxdumper, remuxer, or muxer process an Annex-B elementary stream, they attempt to parse Sequence Parameter Sets (SPS) which contain essential video decoding parameters. If a crafted file lacks a valid or parseable SPS, the initialization functions enter error handling paths. In these paths, the code incorrectly attempts to free memory for objects that were borrowed from other structures rather than newly allocated by the current function scope. Because these objects are shared references, freeing them in this context results in double frees when the original owner later releases its reference or during subsequent cleanup routines.
This flaw directly maps to CWE-415, Double Free, which describes a situation where memory is freed more than once, potentially leading to heap corruption and arbitrary code execution under specific conditions. The immediate operational impact includes application crashes due to segmentation faults triggered by the corrupted heap state. However, beyond simple denial of service, double free vulnerabilities are historically significant because they can be exploited for use-after-free attacks if an attacker can control the memory allocation patterns following the initial invalid free. This allows for potential remote code execution or privilege escalation depending on the context in which L-SMASH is deployed, such as within a web-based video player backend or a media server processing untrusted uploads.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK techniques related to initial access and defense evasion through exploitation of software vulnerabilities. Attackers can craft malicious Annex-B streams that trigger the flawed code path without requiring authentication if the tool is used in an automated pipeline or public-facing service. The lack of proper validation for SPS presence before attempting codec-specific setup creates a predictable attack surface. Mitigation strategies must prioritize updating to patched versions where the memory ownership semantics are corrected, ensuring that borrowed objects are not freed by multiple entities simultaneously. Additionally, implementing strict input validation to reject streams missing critical parameter sets like SPS prior to deep parsing can reduce exposure. Developers should also employ static analysis tools and fuzzing techniques targeting NAL unit parsers to detect similar logic errors in other parts of the multimedia processing pipeline.