CVE-2024-58397
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters(). An attacker can supply an MP4 file whose chapter sample is shorter than its declared title length, causing reads past heap allocations.
Risk Assessment
Applications such as mp4chaps may crash, and adjacent heap memory may leak into chapter titles. Leaked data could contain sensitive information from process memory.
Recommendation
Update MP4v2 to a version newer than 2.1.3 once available. Until then, avoid processing untrusted MP4 files in applications using this library.
Other vulnerabilities in MP4v2
See all- CVE-2026-95122High
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
- CVE-2026-95121High
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction
- CVE-2023-33717Medium
mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by ReadBytes().
- CVE-2023-33719Medium
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4SdpAtom::Read() function in atom_sdp.cpp.
- CVE-2023-33716Medium
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4StringProperty class in mp4property.cpp.
- CVE-2023-33718High
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4File::ReadString() function in mp4file_io.cpp.
- CVE-2023-33720Medium
Version 2.1.2 of the mp4v2 library was discovered to contain a memory leak in the MP4BytesProperty class.
Original NVD description (English source)
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS