CVE-2016-20099 Details
Description
L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c that allows attackers to hang applications via crafted input files. Attackers can supply a file consisting only of zero bytes, which lsmash_read_file() probes automatically, causing indefinite CPU consumption and denial of service.
A denial-of-service vulnerability has been identified in L-SMASH versions through 2.14.5. The issue resides in the VC-1 importer probe function, vc1_importer_probe(), within the file importer/vc1_imp.c. This vulnerability creates an infinite loop that consumes CPU resources indefinitely, effectively hanging applications that use this library. The loop is triggered by input files crafted to exploit this flaw, specifically files that consist solely of zero bytes. When such a file is processed, the lsmash_read_file() function automatically probes the data, leading to excessive CPU usage and application unresponsiveness.
Users can upgrade to the latest version of L-SMASH, where this vulnerability has been addressed. The fix involves modifying the VC-1 importer's error handling to prevent the double-free condition that leads to the infinite loop.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haind-pwn/cve-2016-20099-2026-110599-l-smash-hevc-importer-double-free | CISA-ADP | BundleExploitRemedyTechnical Analysis |
| https://github.com/l-smash/l-smash/blob/v2.14.5/importer/vc1_imp.c#L462-L488 | [email protected] | Source CodeVendor |
| https://github.com/l-smash/l-smash/pull/58 | [email protected] | Issue TrackingVendor |
| https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double-free | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/l-smash-through-2.14.5-infinite-loop-in-vc-1-importer-probe | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| L-SMASH | <= 2.14.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |