CVE-2026-88377
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination.
Risk Assessment
This can lead to denial of service through application crashes when processing malicious MP4 files.
Recommendation
Update Bento4 to a patched version or avoid processing untrusted MP4 files.
Other vulnerabilities in Bento4
See all- CVE-2017-14647High
A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Bento4 version 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14644High
A heap-based buffer overflow was discovered in the AP4_HdlrAtom class in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
- CVE-2017-14639High
The AP4_VisualSampleEntry::ReadFields function in Bento4 1.5.0-617 has an error in the use of character data types, leading to a stack-based buffer underflow and out-of-bounds write. This may result in application crashes or other unspecified impacts.
- CVE-2026-88376High
Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination.
- CVE-2026-36908Medium
A stack overflow vulnerability was found in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of Bento4 before version 1.8.9. Attackers can exploit this by providing a crafted MP4 file, causing a Denial of Service (DoS).
- CVE-2026-36907Medium
A stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of Bento4 before version 1.8.9 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2024-57598Medium
A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in the AP4_TfraAtom() function of Ap4TfraAtom.cpp. A remote attacker can exploit this flaw to cause a denial of service (DoS).
- CVE-2023-38666Medium
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.
Original NVD description (English source)
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS