Description
A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Axiomatic | Bento4 | 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6 | — |
References
- VDB-293517 | Axiomatic Bento4 mp42aac ReadBits heap-based overflow vdb-entry technical-description
- VDB-293517 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #483315 | bento4.com Bento4 v1.6.0 Buffer Overflow third-party-advisory
- https://github.com/axiomatic-systems/Bento4/issues/991 issue-tracking
- https://github.com/user-attachments/files/18434657/seeds.zip exploit