L Smash
Monthly
A double free in L-SMASH through 2.14.5 lets a crafted media file corrupt the heap: the HEVC and H.264 importer probe routines hevc_setup_first_summary() and h264_setup_first_summary() (importer/nalu_imp.c) free borrowed codec-specific objects on error paths, so an Annex-B elementary stream that deliberately lacks a parseable SPS drives a use-after-free, heap corruption, and crash when opened via lsmash_read_file() or the bundled boxdumper, remuxer, or muxer tools. The flaw rates CVSS 4.0 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) and CWE-415, and per the independent assessment exploitation is local and requires a user or operator to open or pipe the malicious file, with impact realistically confined to workflows that feed untrusted media into L-SMASH-based transcode/remux pipelines; no public exploit code and no CISA KEV entry were identified at time of analysis, i.e. no public exploit identified at time of analysis.
A double free in L-SMASH through 2.14.5 lets a crafted media file corrupt the heap: the HEVC and H.264 importer probe routines hevc_setup_first_summary() and h264_setup_first_summary() (importer/nalu_imp.c) free borrowed codec-specific objects on error paths, so an Annex-B elementary stream that deliberately lacks a parseable SPS drives a use-after-free, heap corruption, and crash when opened via lsmash_read_file() or the bundled boxdumper, remuxer, or muxer tools. The flaw rates CVSS 4.0 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) and CWE-415, and per the independent assessment exploitation is local and requires a user or operator to open or pipe the malicious file, with impact realistically confined to workflows that feed untrusted media into L-SMASH-based transcode/remux pipelines; no public exploit code and no CISA KEV entry were identified at time of analysis, i.e. no public exploit identified at time of analysis.