The vulnerability is a double free in the HEVC and H.264 importer probes of L‑SMASH. When an import function receives a crafted Annex‑B elementary stream that lacks a parseable SPS, the software frees borrowed codec‑specific objects on error paths. This results in a use‑after‑free and heap corruption. The immediate consequence is program crashes, and because the heap corruption can be abused to inject arbitrary code, it may lead to remote code execution on the host running the affected utilities.

The affected product is the open‑source L‑SMASH library, v2.14.5 and all prior releases up to that version. The vulnerability is triggered when the lsmash_read_file() function or the boxdumper, remuxer or muxer command‑line tools process a malicious stream.

The CVSS score of 6.9 indicates a high severity and the vulnerability is not included in the CISA KEV catalog. The EPSS score of <1% indicates a low probability of exploitation. Based on the description, the attack vector is likely local or file‑based, as an attacker needs to supply a crafted stream to the affected utilities. However, if those utilities are invoked by untrusted users or process untrusted input, the risk can be elevated to remote execution.