L-SMASH CVE-2026-110599

Exploitation requires the victim to process an attacker-supplied, specially crafted Annex-B H.264/HEVC elementary stream that deliberately lacks a parseable SPS, using lsmash_read_file() or the bundled boxdumper, remuxer, or muxer tools - this triggers the error path that double-frees a borrowed codec-specific object. Limiting factors: the vector is LOCAL (AV:L) with no network path, and it requires user/operator interaction (UI:P) to open or pipe the malicious file through an L-SMASH consumer; no authentication or privileges are needed (PR:N). Risk is realistic only where untrusted media is fed into L-SMASH-based workflows (e.g., automated transcoding/remuxing backends).

This is a genuine but bounded-severity memory-safety flaw, not a top-tier emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9) is internally consistent with the description: exploitation is LOCAL and requires the victim to feed a malicious file to the tool (UI:P), so there is no network-facing, unauthenticated mass-exploitation path. The double free (CWE-415) yields VI:H/VA:H (potential memory corruption plus reliable crash) but VC:N (no information disclosure), which aligns with a heap-corruption/DoS primitive whose escalation to code execution is plausible but unproven. No EPSS score was provided and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. The 'Denial Of Service' tag understates the issue slightly - a double free can corrupt the heap beyond a mere crash - but conservatively DoS is the confirmed impact. A public technical write-up (hackmd) and a VulnCheck advisory exist with exact vulnerable line references, lowering the barrier to building a trigger, but no packaged weaponized exploit or KEV listing confirms in-the-wild use. Net: prioritize for patching in any pipeline that processes untrusted video streams through L-SMASH, but this is a local/UI-gated issue rather than a drop-everything remote CVE.

An attacker crafts a malformed Annex-B H.264/HEVC elementary stream that lacks a parseable SPS and distributes it (e.g., as a sample 'video' or via an automated media-processing service). When a victim or backend pipeline runs boxdumper, remuxer, muxer, or any application calling lsmash_read_file() on the file, the error path in hevc_setup_first_summary()/h264_setup_first_summary() frees a borrowed codec-specific object twice, causing use-after-free and heap corruption that at minimum crashes the process. A detailed public write-up documents the exact faulting code, so a working trigger file is straightforward to reproduce.