CVE-2026-88377: Bento4 Bento4 vulnerability
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4ATOMHEADERSIZE can cause AP4AvccAtom::Create() or AP4HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4DataBuffer copy path, resulting in application termination and denial of service.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker needs to supply a specially crafted MP4 file containing an avcC or hvcC configuration atom whose declared size is smaller than AP4_ATOM_HEADER_SIZE. Processing that file can reach the vulnerable atom parsers.
What is the expected impact?
The malformed atom causes an underflow in payload-size calculation and can lead to invalid or NULL pointers reaching the AP4_DataBuffer copy path. The described impact is application termination and denial of service.
Which code paths are implicated?
The issue is in the avcC and hvcC configuration atom parsers, specifically AP4_AvccAtom::Create() and AP4_HvccAtom::Create().