L-SMASH versions up to 2.14.5 contain a heap out‑of‑bounds write that is triggered when the parser processes oversized hdlr or url boxes in MP4 or MOV media files. The overflow corrupts heap memory and causes the application to terminate. The vulnerability does not provide direct remote code execution; it primarily results in program crashes and can be leveraged to disrupt service for any user or system that processes malicious media.

The affected product is the L‑SMASH library, specifically version 2.14.5 and earlier. The issue exists in the core/read.c functions isom_read_hdlr() and isom_read_dref_entry(). Users running these versions should verify their installed build and consider updating to a later release.

The CVSS score of 6.9 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS data is available. Because the flaw is triggered by a crafted media file, an attacker who can supply a malicious MP4/MOV to the application can easily exercise the overflow, leading to a denial‑of‑service event. The exploit requires local file access or the ability to influence media consumption by the affected software, and it does not provide persistence or elevated privileges.