CVE-2026-88376 Details
Description
Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination, leading to denial of service.
An integer underflow vulnerability has been identified in Bento4 version 1.6.0.0. The issue arises in the AVC and HEVC configuration atom parsers, specifically in the 'Create' methods of 'AP4_AvccAtom' and 'AP4_HvccAtom'. When a specially crafted MP4 file is processed, the declared size of the 'avcC' or 'hvcC' atom can be smaller than the required header size. This discrepancy causes the payload size calculation to underflow, resulting in an oversized buffer allocation. The subsequent invalid buffer operations can lead to application crashes, causing a denial-of-service condition.
Users are advised to update to the latest version of Bento4, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axiomatic-systems/Bento4/issues/1091 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/axiomatic-systems/Bento4/issues/1091 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Bento4 | 1.6.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |