Heap out-of-bounds read in MP4v2 lets crafted MP4 files leak memory
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters (CWE-125). A local attacker can supply an MP4 file whose chapter sample is shorter than its declared title length, so that when a user opens it, applications such as mp4chaps crash or leak adjacent heap memory into chapter titles.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for MP4v2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2024-58397
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-18 CISA SSVC decision points changed
- 2026-10-18 Priority changed: LOW → MEDIUM
- 2026-10-18 Alias added: GHSA-rpfq-3w7q-qcrv
References
Sources
- CVE-2024-58397 · CVE Program
- CVE-2024-58397 · NVD
- FIRST EPSS
- GHSA-rpfq-3w7q-qcrv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences