Denial of Service Vulnerability in Bento4 by Axiomatic Systems
CVE-2026-36907

5.5MEDIUM

Key Information:

Vendor

Axiomatic Systems

Status
Bento4
Vendor
CVE Published:
26 June 2026

What is CVE-2026-36907?

A vulnerability exists in the AP4_StsdAtom::AP4_StsdAtom component of Bento4, allowing attackers to exploit a stack overflow. This could be triggered by a specially crafted MP4 file, potentially leading to a Denial of Service condition. Users of Bento4 versions prior to v1.8.9 are at risk and should upgrade to mitigate this issue.

References

https://github.com/axiomatic-systems/Bento4/issues/614
https://github.com/Aleksoid1978/MPC-BE/issues/1005

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.