CVE-2024-57598
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in the AP4_TfraAtom() function of Ap4TfraAtom.cpp. A remote attacker can exploit this flaw to cause a denial of service (DoS).
Risk Assessment
The risk is that a remote attacker can crash the application, leading to service disruption and potential loss of availability for users.
Recommendation
It is recommended to immediately update Bento4 to the latest version that fixes the divide-by-zero issue. If not available, restrict access to the application or apply temporary mitigations.
Other vulnerabilities in Bento4
See all- CVE-2017-14647High
A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Bento4 version 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14644High
A heap-based buffer overflow was discovered in the AP4_HdlrAtom class in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14639High
The AP4_VisualSampleEntry::ReadFields function in Bento4 1.5.0-617 has an error in the use of character data types, leading to a stack-based buffer underflow and out-of-bounds write. This may result in application crashes or other unspecified impacts.
- CVE-2026-88377Low risk· EPSS 3%
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination.
- CVE-2026-88376High
Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination.
- CVE-2026-36908Medium
A stack overflow vulnerability was found in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of Bento4 before version 1.8.9. Attackers can exploit this by providing a crafted MP4 file, causing a Denial of Service (DoS).
- CVE-2026-36907Medium
A stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of Bento4 before version 1.8.9 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2023-38666Medium
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.
Original NVD description (English source)
A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp which allows a remote attacker to cause a denial of service vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS