CVE-2026-110599

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

CVE-2026-110599

L-SMASH versions through 2.14.5 are vulnerable to a double free vulnerability within the hevc_setup_first_summary() and h264_setup_first_summary() functions located in importer/nalu_imp.c. The root cause is the improper freeing of borrowed codec-specific objects during error paths. An attacker ca...

CVE-2026-110599 L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

EUVD-2026-101227

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...