CVE-2026-110599 l-smash CVE debrief

Who should care

Defenders responsible for media processing systems, developers using L-SMASH, and security teams assessing vulnerability exposure should prioritize verifying and mitigating this vulnerability.

Why it matters

CVE-2026-110599 is a double free vulnerability in L-SMASH through 2.14.5 that can lead to system crashes, heap corruption, and potential exploitation through crafted media files. Defenders should verify L-SMASH versions, assess exposure, and implement compensating controls to mitigate potential impacts.

• Potential for system crashes or instability
• Risk of heap corruption leading to unpredictable behavior
• Need for verification of L-SMASH version and exposure
• Possible exploitation through crafted media files

Technical summary

The double free vulnerability in L-SMASH through 2.14.5 occurs in the hevc_setup_first_summary() and h264_setup_first_summary() functions in importer/nalu_imp.c. This can be triggered by supplying a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or certain tools, leading to use-after-free, heap corruption, and crashes. The vulnerability is confirmed in L-SMASH version 2.14.5 and may affect media processing systems using this library. Defenders should prioritize verifying the vulnerability in L-SMASH versions up to 2.14.5 and assessing exposure in their environments.

Defensive priority

Defenders should prioritize verifying the vulnerability in L-SMASH versions up to 2.14.5 and assessing exposure in their environments, especially where the software is used for media processing.

Recommended defensive actions

• Verify L-SMASH version 2.14.5 or earlier is in use and assess exposure
• Review media processing workflows for potential vulnerability exploitation
• Implement compensating controls to mitigate potential impacts
• Monitor for and respond to potential crashes or corruption indicative of exploitation
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in L-SMASH version 2.14.5. Official sources include the CVE Program record and the NVD vulnerability detail page. Evidence is limited to publicly available information and may not reflect the full scope of affected systems or potential impacts. Defenders should verify L-SMASH versions, assess exposure, and implement compensating controls to mitigate potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.