# CVE-2026-88377: Bento4 integer underflow in MP4 atom parsing

Source: https://junglewise.ai/threats/cve-2026-88377-bento4-1-6-0-0-contains-an-integer-underflow-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88377 · Severity: info · Published 2026-09-24

Bento4 is a C++ library used to parse and manipulate MP4 video files. A flaw in how it validates atom headers when reading avcC (H.264 video) and hvcC (H.265 video) configuration data allows an attacker to craft a malicious MP4 file that triggers an integer underflow, causing the application to crash and denying service to users trying to process the file.

Technologies: [Axiomatic Systems Bento4](https://junglewise.ai/threats/technologies/bento4). Vendors: [Axiomatic Systems](https://junglewise.ai/threats/vendors/axiomatic-systems).

## Quick answers

**Is CVE-2026-88377 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88377 being exploited in the wild.

**How severe is CVE-2026-88377?** Informational severity, published 24 September 2026.

**Which products and versions are affected?** Axiomatic Systems Bento4 1.6.0.0.

**Is there a fix for CVE-2026-88377?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88377 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-88377?** Check whether you run Axiomatic Systems Bento4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer underflow (CWE-787) in AP4_AvccAtom::Create() and AP4_HvccAtom::Create() functions. When an MP4 atom header declares a size smaller than the 8-byte header itself (AP4_ATOM_HEADER_SIZE), the payload_size calculation wraps to a huge unsigned value, allowing a buffer overread and invalid pointer dereference in the AP4_DataBuffer copy operation. Attack vector is local/network (file parsing); no authentication or user interaction required beyond opening the malformed MP4.

## Affected products

- Axiomatic Systems Bento4 1.6.0.0

## Timeline

- 2026-09-24: disclosed

## References

- [https://github.com/axiomatic-systems/Bento4/issues/1092](https://github.com/axiomatic-systems/Bento4/issues/1092)

## Related threats

- [Bento4 integer underflow in avcC/hvcC atom parsing](https://junglewise.ai/threats/cve-2026-88376-bento4-1-6-0-0-contains-an-integer-underflow-vulnerability-in-ap4)
- [axiomatic-systems Bento4 stack overflow in AP4_TrunAtom](https://junglewise.ai/threats/cve-2026-36908-axiomatic-systems-bento4-stack-overflow-in-ap4-trunatom)
- [Axiomatic-systems Bento4 stack overflow in AP4_StsdAtom](https://junglewise.ai/threats/cve-2026-36907-axiomatic-systems-bento4-stack-overflow-in-ap4-stsdatom)