Is CVE-2026-95121 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95121 being exploited in the wild.

How severe is CVE-2026-95121?

High severity, with a CVSS score of 7.8, published 13 October 2026.

Is there a fix for CVE-2026-95121?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-95121 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-95121?

Check whether you run TechSmith Mp4v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95121: mp4v2 integer underflow in RTP atom parsing

CVE-2026-95121 · Severity: high · CVSS 7.8 · Published 2026-10-13

mp4v2 is a library for reading and writing MP4 video files. A flaw in how it parses specially crafted MP4 files can cause it to attempt allocating an enormous amount of memory (near 2 trillion bytes), leading to a denial-of-service crash when processing a malicious file. An attacker can trigger this by sending a crafted MP4 file to an application using mp4v2.

Technologies: TechSmith Mp4v2. Vendors: TechSmith.

Quick answers

Is CVE-2026-95121 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95121 being exploited in the wild.
How severe is CVE-2026-95121?: High severity, with a CVSS score of 7.8, published 13 October 2026.
Which products and versions are affected?: TechSmith Mp4v2 2.0.0.
Is there a fix for CVE-2026-95121?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-95121 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-95121?: Check whether you run TechSmith Mp4v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow in MP4RtpAtom::ReadHntiType() occurs when parsing an undersized rtp atom within an hnti container. The vulnerable code computes size as GetEnd() - m_File.GetPosition() without bounds checking; if the atom is too small, this subtraction underflows to a near-2^64 value, which is passed directly to MP4Malloc(). This triggers an excessive memory allocation attempt (CWE-191, CWE-789), causing denial of service.

Affected products

TechSmith mp4v2 2.0.0

Timeline

2026-10-13: disclosed
2026-10-10: other: Advisory published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.