CVE-2026-120456

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isomreadhdlr and isomreaddrefentry in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position an...

CVE-2026-120456 L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isomreadhdlr and isomreaddrefentry in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position an...

CVE-2026-120456

L-SMASH versions up to 2.14.5 are vulnerable to a heap out-of-bounds write in the isom_read_hdlr() and isom_read_dref_entry() functions located in core/read.c. The vulnerability is triggered when processing crafted MP4 or MOV files that declare hdlr or url box sizes larger than the remaining data...

EUVD-2026-115216

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isomreadhdlr and isomreaddrefentry in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position an...