CVE-2026-120456 in L-SMASH
Summary
by MITRE • 11/02/2026
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in L-SMASH versions up to 2.14.5 represents a critical security flaw within the media parsing engine, specifically located in the core/read.c module during the processing of ISO Base Media File Format structures. This library is widely utilized for decoding and manipulating multimedia containers such as MP4 and MOV files, which are ubiquitous across digital platforms. The specific weakness resides in two functions: isom_read_hdlr() responsible for handling handler boxes, and isom_read_dref_entry() tasked with processing data reference entries. These components are fundamental to how the parser interprets metadata and references within a media file structure. When an attacker supplies a crafted MP4 or MOV file that declares hdlr or url box sizes exceeding the actual remaining data in the stream, the library fails to perform adequate bounds checking before attempting memory operations. This oversight allows for a heap out-of-bounds write condition where the parser writes data beyond the allocated buffer boundaries defined by the declared size versus the available payload length.
From a technical perspective, this flaw stems from insufficient validation of box sizes against the actual file content during the parsing phase. The isom_read_hdlr() function processes handler boxes which define the type and name of media tracks, while isom_read_dref_entry() handles data references that point to external or internal resources. In both cases, the code assumes that the size field in the box header accurately reflects the amount of valid data available for reading. By manipulating these fields to be larger than the remaining bytes in the file stream, an attacker can force the parser to read past the end of allocated memory regions. This action stalls the internal stream position pointer and leads to corruption of heap memory structures adjacent to the target buffer. The immediate operational impact is often a crash or denial of service as the application encounters invalid memory access errors. However, given that this involves arbitrary write operations on the heap, there is significant potential for remote code execution if an attacker can carefully craft the overflow payload to overwrite function pointers or object headers within the process address space.
This vulnerability aligns with Common Weakness Enumeration CWE-787: Out-of-bounds Write and CWE-125: Out-of-bounds Read, as it involves accessing memory outside of intended boundaries due to improper size validation. In terms of attack vectors, this falls under MITRE ATT&CK technique T1046: Network Service Scanning or more specifically T1190: Exploit Public-Facing Application if the vulnerable library is exposed via a web service that accepts user-uploaded media files. The exploitation requires an attacker to deliver a maliciously crafted multimedia file, which could be achieved through phishing emails with attached videos, compromised websites hosting infected media content, or direct upload interfaces in applications utilizing L-SMASH for video processing. Once executed, the vulnerability can lead to application instability, data leakage from adjacent memory regions, or full system compromise depending on the context of the running process and available exploit mitigations such as ASLR and DEP.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade L-SMASH to a version newer than 2.14.5 where these bounds checking issues have been addressed by the maintainers. For environments unable to update immediately, input validation at the application layer should be implemented to verify that declared box sizes do not exceed the actual file size or remaining buffer length before passing data to the library. Additionally, deploying sandboxing mechanisms for media processing services can limit the impact of successful exploitation by restricting memory access privileges and preventing arbitrary code execution. Security teams should also monitor for anomalous behavior in applications handling multimedia files, such as unexpected crashes or high CPU usage during file parsing, which may indicate active probing or exploitation attempts targeting this vulnerability class.