CVE-2026-120456
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c trigg
CVSS
6.1
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 2 nov 2026 · Última mod.: 2 nov 2026 · CWE-787
Sin historial EPSS suficiente todavía.
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.
- github.comhttps://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L688-L717
- github.comhttps://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L853-L876
- github.comhttps://github.com/l-smash/l-smash/commit/805ee3c9632e054198d3cb5b09c7b7aa36cdd791
- github.comhttps://github.com/l-smash/l-smash/issues/112
- hackmd.iohttps://hackmd.io/@haindpwn/lsmash-hdlr-dref-box-size-oob-write
- www.vulncheck.comhttps://www.vulncheck.com/advisories/l-smash-through-2.14.5-heap-out-of-bounds-write-via-hdlr-and-url-boxes
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-115653——
———In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.2hCVE-2026-1204556.1 MED—
———rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.4hCVE-2026-1204525.4 MED—
———libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.4hCVE-2026-1204516.8 MED—
———libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.4hCVE-2026-1204357.8 ALT—
———Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.4hCVE-2026-107457——
——0A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.10h