CVE-2026-120456
Medium
Description
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.
SeverityMedium
CVSS6.1
Exploit probability—
ProductL-SMASH
PublishedNov 2, 2026
First seenNov 4, 2026
Weakness typeCWE-787Out-of-bounds write
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| L-SMASH L-SMASH | v ≤ 2.14.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.