CVE-2026-5235: Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow
A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5235?
CVE-2026-5235 has a high severity due to its potential for heap-based buffer overflow.
How do I fix CVE-2026-5235?
To fix CVE-2026-5235, update Axiomatic Bento4 to version 1.6.0-642 or later.
What components are affected by CVE-2026-5235?
CVE-2026-5235 affects the AP4_BitReader::ReadCache function in the Ap4Dac4Atom.cpp file of the MP4 File Parser component.
What are the exploitation consequences of CVE-2026-5235?
Exploitation of CVE-2026-5235 could lead to denial of service or remote code execution.
Who is responsible for addressing CVE-2026-5235?
The maintainers of Axiomatic Bento4 are responsible for addressing CVE-2026-5235 through software updates.