---
id: "CVE-2026-120456"
kind: "vulnerability"
aliases: ["CVE-2026-120456"]
title: "L-SMASH: crafted MP4 files corrupt heap memory and crash apps"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["l-smash", "media-processing", "mov", "mp4", "package"]
not_affected_if: ["library-not-used", "no-untrusted-media"]
published_at: "2026-11-02T15:17:29+00:00"
first_seen_at: "2026-11-02T15:24:03+00:00"
updated_at: "2026-11-02T15:26:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120456", "first_seen_at": "2026-11-02T15:24:03+00:00"}]
---

# L-SMASH: crafted MP4 files corrupt heap memory and crash apps

L-SMASH is a library for reading and writing MP4 and MOV media files. A crafted file with oversized box sizes makes the parser write past a heap buffer, corrupting memory and crashing the application that opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `L-SMASH` library (liblsmash) is linked into any application or build you run, for example with `ldd` on the binary or by searching the dependency manifest.
- Confirm the installed version against the range in the sources: through `2.14.5`.

## Timeline

- 2026-11-02T15:24:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120456

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/l-smash-through-2.14.5-heap-out-of-bounds-write-via-hdlr-and-url-boxes
- [fix] Patch: github.com https://github.com/l-smash/l-smash/commit/805ee3c9632e054198d3cb5b09c7b7aa36cdd791

## From the sources

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_