CVE-2026-36907: Bento4 Stack Overflow in MP4 Parsing – DoS Vulnerability

Technical summary

CVE-2026-36907 is a stack buffer overflow (CWE-121) in the AP4_StsdAtom::AP4_StsdAtom constructor within axiomatic-systems Bento4 prior to version 1.8.9. The vulnerability is triggered during MP4 file parsing when the stsd (sample description) atom is malformed. The overflow can cause memory corruption on the stack, leading to application crash or potential control flow hijacking. The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack surface, no privileges required, user interaction necessary, and availability impact only.

Business impact

Organizations using Bento4 for media processing, transcoding pipelines, or embedded MP4 handling face availability disruption if an attacker supplies a weaponized MP4 file. Automated workflows (batch video processing, media validation services) are at higher risk since they may process untrusted files without human review. This is not a confidentiality or integrity threat, but repeated crashes can degrade service reliability and increase operational support costs.

Affected systems

Bento4 versions prior to 1.8.9 are affected. Bento4 is used in media players, streaming platforms, video editing tools, and backend media processing services. Any deployment or product incorporating the vulnerable Bento4 library is at risk if it processes MP4 files from untrusted sources. The vendor product list was not populated in the ground-truth source, so operators should audit their software bill of materials (SBOM) for Bento4 presence and version.

Exploitability

Exploitation requires local file system access and user or process interaction to open a crafted MP4 file. No network vector, no authentication bypass, and no remote execution. The attack is straightforward—a malicious MP4 file designed to overflow the stsd atom parser—but the impact is limited to denial of service. This is not currently tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been publicly disclosed.

Remediation

Upgrade Bento4 to version 1.8.9 or later. Organizations should verify their upgrade path with the vendor, as dependency chains and build systems may require coordination. Interim mitigations include restricting MP4 file processing to trusted sources, implementing file validation before parsing, and running media processing in isolated or sandboxed environments to limit crash impact.

Patch guidance

Apply Bento4 version 1.8.9 or later. Verify the patch availability through the axiomatic-systems official release channels and test in a staging environment before production rollout. If Bento4 is embedded in a larger product, confirm that the product's maintainer has released an update incorporating the patched library. Check release notes to ensure no breaking changes affect your media pipeline.

Detection guidance

Monitor for crash logs or abnormal termination of Bento4-based processes when processing MP4 files. Implement file integrity and reputation scanning for uploaded or ingested MP4s. If feasible, enable stack canaries or memory sanitizers (ASAN, Valgrind) during development to catch buffer overflows early. Log all MP4 file processing errors and correlate spikes in crashes with suspicious file sources.

Why prioritize this

While the CVSS score is MEDIUM, prioritization depends on your usage pattern. If Bento4 is exposed in an automated, internet-facing media processing service, upgrade immediately. If Bento4 is used only in offline, trusted workflows, patching can be scheduled in a standard maintenance window. The lack of KEV designation and network exploitability means this is not a critical emergency, but should not be indefinitely delayed.

Risk score, explained

CVSS 5.5 reflects: (1) local attack vector only, (2) low attack complexity, (3) no privilege escalation needed, (4) user interaction required (file must be opened/processed), (5) isolated scope (no lateral spread), (6) high availability impact (crash). The score does not account for prevalence of Bento4 in your infrastructure or the sensitivity of your media processing pipeline—those factors should inform your internal risk rating.

Frequently asked questions