Read the docs
TI-2026-04573 Aliases CVE-2026-5236GHSA-9jwv-5qpr-m876

Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow

Priority MEDIUM 55CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AxiomaticBento41.6.0-641—No fix listedCNA
  • Bento4 VendorAxiomatic Affected 1.6.0-641 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*——Bento4
  • cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:* Versions — — ·Bento4

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5236
  2. 2026-10-03 Alias added: GHSA-9jwv-5qpr-m876

References

Exploit 1

Other 1

  • TI-2024-20431 Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to… CVSS 3.1HIGH 8.8
  • TI-2022-03375 Axiomatic Bento4 mp42hevc WriteSample heap-based overflow CVSS 3.1HIGH 7.8
  • TI-2022-03371 Axiomatic Bento4 mp42ts Ap4LinearReader.cpp Advance use after free CVSS 3.1HIGH 7.8
  • TI-2022-03370 Axiomatic Bento4 avcinfo AvcInfo.cpp heap-based overflow CVSS 3.1HIGH 7.8
  • TI-2022-03369 Axiomatic Bento4 avcinfo Ap4BitStream.cpp WriteBytes heap-based overflow CVSS 3.1HIGH 7.8
  • TI-2022-03367 Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free CVSS 3.1HIGH 7.8
See all 157 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences