L-SMASH EUVD-2026-115216

Exploitation requires an application that uses L-SMASH (through 2.14.5) to parse an attacker-supplied MP4 or MOV file; the malicious file must declare an hdlr box or a dref 'url ' entry box whose size is larger than the remaining data in the stream, which stalls the stream position and drives the heap out-of-bounds write. The flaw is local file-parsing (AV:L) and needs victim interaction to open/process the file (UI:P per CVSS 4.0, PR:N - no authentication). Limiting factors: the attacker cannot reach the code path without the victim feeding the crafted media to a vulnerable L-SMASH build, and the observed effect is memory corruption leading to a crash rather than a confirmed code-execution primitive.

This is a medium-severity, local-vector memory-corruption flaw (CVSS 4.0 base 6.9). The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) shows the dominant impact is availability (VA:H) - i.e. crashing the host application - with only limited integrity impact (VI:L) from the heap write and no confidentiality impact (VC:N). Exploitation is not remote-automatable: it requires a victim to process an attacker-supplied file (UI:P), so the vector is local file-parsing rather than network service exploitation. No EPSS score was provided, so exploitation-probability cannot be quantified; the CVE is NOT listed in CISA KEV, so there is no confirmation of active exploitation. Several PoC-style references exist (the upstream issue, a HackMD writeup, and a VulnCheck advisory), but the input does not confirm any of them as working exploit code. The vuln.today decision label is 'this_month', consistent with a patchable, non-emergency memory-safety bug whose realistic worst case is denial of service rather than reliable remote code execution. Net: a legitimate bug to patch in the normal cycle, not a drop-everything emergency - and the low real-world footprint of the affected library further tempers urgency. The only notable nuance is that a heap out-of-bounds write (CWE-787) can sometimes be escalated beyond a crash, but the available evidence describes the observed effect only as heap corruption that crashes applications, so anything beyond DoS is unverified.

An attacker crafts an MP4 or MOV file whose hdlr box or dref url entry declares a box size larger than the remaining data, then delivers it to a victim who opens or transcodes it with an application built on L-SMASH ≤ 2.14.5. During parsing the oversized box size stalls the stream position and triggers a heap out-of-bounds write that corrupts memory and crashes the application. A public PoC reference exists (upstream issue #112, a HackMD writeup, and a VulnCheck advisory); it is not verified as working exploit code.