The flaw is an infinite loop in the vc1_importer_probe function of l-smash up to version 2.14.5. It triggers when a file consisting only of zero bytes is processed, causing the importer to cycle endlessly and drain CPU resources. The resulting denial of service can bring applications using l-smash to a halt. This weakness is a classic Infinite Loop error, identified by CWE-835.

The affected product is l-smash, all releases up to and including 2.14.5. No specific sub‑components are listed beyond the vc1 importer. Users running any version of l-smash that employs this importer should be aware that crafted zero‑byte files can trigger the issue.

The CVSS score of 6.8 indicates high severity. EPSS is 0.00237 (<1%), indicating a very low probability of exploitation, but given that only a crafted file is needed, the barrier remains low. The vulnerability is not in the CISA KEV catalog. Attackers can exploit it by creating a zero‑byte file and having the target application read it, leading to a server or client slowdown. Given the lack of a network‑exposed trigger, the attack vector appears to be local or via application input rather than arbitrary remote code execution.