CVE-2025-25944 Details
Description
Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RtpAtom, during the execution of mp4fragment with a crafted MP4 input file.
A buffer overflow vulnerability has been identified in Bento4 version 1.6.0-641. This vulnerability allows a local attacker to execute arbitrary code by exploiting the AP4_RtpAtom component while processing crafted MP4 files with the mp4fragment tool. The issue arises in the AP4_RtpAtom::AP4_RtpAtom constructor, as detailed in the vulnerability report.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axiomatic-systems/Bento4/issues/993 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| axiosys bento4 | 1.6.0-641 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2025 | Initial Analysis | [email protected] |
| Feb 20, 2025 | CVE Modified | CISA-ADP |
| Feb 19, 2025 | New CVE Received | [email protected] |