Axiomatic Bento4 mp42aac heap-based overflow
CVE-2022-4584

6.3MEDIUM

Key Information:

Vendor: Axiomatic
Status: Bento4
Vendor: CVE Published:; 17 December 2022

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2022-4584?

A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216170 is the identifier assigned to this vulnerability.

Affected Version(s)

Bento4 1.6.0-639

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-4584 - Proof of Concept

References

https://vuldb.com/?id.216170

vdb-entrytechnical-description

https://vuldb.com/?ctiid.216170

signaturepermissions-required

https://github.com/axiomatic-systems/Bento4/issues/818

issue-tracking

CVSS V3.1

Score:

6.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

CVSS V3.0