---
id: CVE-2026-120456
title: L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes
summary: >-
  L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in
  isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by
  oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring
  hdlr or url …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: L-SMASH
product: L-SMASH
affected:
  - L-SMASH <= 2.14.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:04:42.778934Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:31:43.292Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120456'
references:
  - url: 'https://github.com/l-smash/l-smash/issues/112'
  - url: >-
      https://github.com/l-smash/l-smash/commit/805ee3c9632e054198d3cb5b09c7b7aa36cdd791
  - url: 'https://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L688-L717'
  - url: 'https://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L853-L876'
  - url: 'https://hackmd.io/@haindpwn/lsmash-hdlr-dref-box-size-oob-write'
  - url: >-
      https://www.vulncheck.com/advisories/l-smash-through-2.14.5-heap-out-of-bounds-write-via-hdlr-and-url-boxes
    label: >-
      VulnCheck Advisory: L-SMASH through 2.14.5 Heap Out-of-Bounds Write via
      hdlr and url Boxes
tags:
  - cve.org
epss: 0.00157
epssPercentile: 0.04911
ingestedAt: '2026-11-05T19:30:42.729Z'
---

## Overview

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.

## Affected

- `L-SMASH <= 2.14.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.