Is CVE-2024-58397 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58397 being exploited in the wild.

How severe is CVE-2024-58397?

Medium severity, with a CVSS score of 6.1, published 15 October 2026.

Is there a fix for CVE-2024-58397?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-58397 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-58397?

Check whether you run MP4v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58397: MP4v2 heap-based out-of-bounds read in GetChapters()

CVE-2024-58397 · Severity: medium · CVSS 6.1 · Published 2026-10-15

MP4v2 is a library for reading and manipulating MP4 video files. An attacker can craft a malicious MP4 file with invalid chapter metadata to crash applications using the library or leak sensitive data from the program's memory. This affects any tool or service that processes MP4 files with chapter information, such as mp4chaps.

Quick answers

Is CVE-2024-58397 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58397 being exploited in the wild.
How severe is CVE-2024-58397?: Medium severity, with a CVSS score of 6.1, published 15 October 2026.
Which products and versions are affected?: MP4v2 through 2.1.3.
Is there a fix for CVE-2024-58397?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-58397 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-58397?: Check whether you run MP4v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based out-of-bounds read vulnerability exists in the MP4File::GetChapters() function when processing QuickTime chapter samples. An attacker can supply an MP4 file where a chapter sample is shorter than its declared title length, causing the function to read past the allocated heap buffer. This results in either a crash or disclosure of adjacent heap memory contents.

Affected products

MP4v2 through 2.1.3

Timeline

2024-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.