Read the docs
TI-2026-04572 Aliases CVE-2026-5235GHSA-g59j-6cjm-qfw8

Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow

Priority MEDIUM 55CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AxiomaticBento41.6.0-641—No fix listedCNA
  • Bento4 VendorAxiomatic Affected 1.6.0-641 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*——Bento4
  • cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:* Versions — — ·Bento4

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5235
  2. 2026-10-03 Alias added: GHSA-g59j-6cjm-qfw8

References

Exploit 1

Other 1

  • TI-2024-20431 Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to… CVSS 3.1HIGH 8.8
  • TI-2022-03375 Axiomatic Bento4 mp42hevc WriteSample heap-based overflow CVSS 3.1HIGH 7.8
  • TI-2022-03371 Axiomatic Bento4 mp42ts Ap4LinearReader.cpp Advance use after free CVSS 3.1HIGH 7.8
  • TI-2022-03370 Axiomatic Bento4 avcinfo AvcInfo.cpp heap-based overflow CVSS 3.1HIGH 7.8
  • TI-2022-03369 Axiomatic Bento4 avcinfo Ap4BitStream.cpp WriteBytes heap-based overflow CVSS 3.1HIGH 7.8
  • TI-2022-03367 Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free CVSS 3.1HIGH 7.8
See all 157 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences