CVE-2026-36908
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A stack overflow vulnerability was found in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of Bento4 before version 1.8.9. Attackers can exploit this by providing a crafted MP4 file, causing a Denial of Service (DoS).
Risk Assessment
The organization is at risk of DoS attacks that can disrupt applications using Bento4 for MP4 file processing, potentially leading to service unavailability.
Recommendation
Immediately update Bento4 to version 1.8.9 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Bento4
See all- CVE-2017-14647High
A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Bento4 version 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14644High
A heap-based buffer overflow was discovered in the AP4_HdlrAtom class in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14639High
The AP4_VisualSampleEntry::ReadFields function in Bento4 1.5.0-617 has an error in the use of character data types, leading to a stack-based buffer underflow and out-of-bounds write. This may result in application crashes or other unspecified impacts.
- CVE-2026-36907Medium
A stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of Bento4 before version 1.8.9 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2024-57598Medium
A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in the AP4_TfraAtom() function of Ap4TfraAtom.cpp. A remote attacker can exploit this flaw to cause a denial of service (DoS).
- CVE-2023-38666Medium
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.
Original NVD description (English source)
A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.