CVE-2026-36907
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of Bento4 before version 1.8.9 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Risk Assessment
The risk is that an attacker can remotely crash an application using Bento4 by sending a malicious MP4 file, potentially disrupting service availability.
Recommendation
It is recommended to immediately upgrade Bento4 to version 1.8.9 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Bento4
See all- CVE-2017-14647High
A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Bento4 version 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14644High
A heap-based buffer overflow was discovered in the AP4_HdlrAtom class in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14639High
The AP4_VisualSampleEntry::ReadFields function in Bento4 1.5.0-617 has an error in the use of character data types, leading to a stack-based buffer underflow and out-of-bounds write. This may result in application crashes or other unspecified impacts.
- CVE-2026-36908Medium
A stack overflow vulnerability was found in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of Bento4 before version 1.8.9. Attackers can exploit this by providing a crafted MP4 file, causing a Denial of Service (DoS).
- CVE-2024-57598Medium
A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in the AP4_TfraAtom() function of Ap4TfraAtom.cpp. A remote attacker can exploit this flaw to cause a denial of service (DoS).
- CVE-2023-38666Medium
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.
Original NVD description (English source)
A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.