CVE-2026-110599 Details
Description
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
A double free vulnerability has been identified in L-SMASH versions through 2.14.5, specifically within the HEVC and H.264 importers. The issue arises in the 'hevc_setup_first_summary' and 'h264_setup_first_summary' functions, located in 'importer/nalu_imp.c'. The vulnerability occurs when these functions free borrowed codec-specific objects on error paths, leading to a use-after-free condition, heap corruption, and crashes. This vulnerability can be exploited by supplying a crafted Annex-B elementary stream that lacks a parseable SPS, either through the 'lsmash_read_file' function or via the command-line tools 'boxdumper', 'remuxer', or 'muxer'.
The vulnerability can be fixed by removing the erroneous frees of the borrowed 'lsmash_codec_specific_t' objects in both the HEVC and H.264 importers, and ensuring that the list's ownership of these objects is respected.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haind-pwn/cve-2016-20099-2026-110599-l-smash-hevc-importer-double-free | CISA-ADP | BundleExploitRemedyTechnical Analysis |
| https://github.com/l-smash/l-smash/blob/v2.14.5/importer/nalu_imp.c#L1356-L1378 | [email protected] | Source CodeVendor |
| https://github.com/l-smash/l-smash/blob/v2.14.5/importer/nalu_imp.c#L697-L715 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double-free | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/l-smash-through-2.14.5-double-free-in-hevc-and-h-264-importer-probe | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| L-SMASH | <= 2.14.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |