Executive brief
Bento4 is a C++ library and toolset used for processing MP4 and other multimedia files. A vulnerability in how it handles specific media metadata (atoms) allows an attacker to crash applications using the library by providing a specially crafted MP4 file. This could lead to a denial-of-service condition for users opening malicious media content.
Technical details
A stack overflow vulnerability exists in the Bento4 library within the AP4_StsdAtom::AP4_StsdAtom component. The issue is triggered during the parsing of Sample Description (stsd) atoms in MP4 files. An attacker can exploit this by providing a malformed MP4 file that causes excessive recursion or improper memory allocation during atom factory processing, leading to a crash (Denial of Service). The vulnerability is reachable via local file execution or any application that utilizes Bento4 to parse untrusted media streams. The issue is addressed in version 1.8.9.
Affected products
- axiomatic-systems Bento4 before v1.8.9
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory