Executive brief
Bento4 is a popular library and toolset used for processing MP4 and other digital media files. A vulnerability in how it handles specific media data structures allows an attacker to crash applications using the library by providing a specially crafted MP4 file. This can lead to a denial-of-service, impacting the availability of media processing services or applications like media players.
Technical details
A vulnerability exists in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of Bento4. The issue is triggered when the library attempts to process a Track Run Atom (trun) within a crafted MP4 file, leading to an uncontrolled memory allocation or stack exhaustion during capacity adjustment. An attacker can exploit this by providing a malicious MP4 file to an application linked with Bento4, such as mp42aac or media players like MPC-BE. This results in an out-of-memory (OOM) condition or a crash, causing a denial of service. The vulnerability is addressed in version 1.8.9.
Affected products
- axiomatic-systems Bento4 before v1.8.9
Timeline
- 2023-03-14: disclosed: Initial issue reported on GitHub
- 2026-06-26: advisory: CVE published to NVD