CVE-2024-58397 in mp4v2
Summary
by MITRE • 10/16/2026
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in the MP4v2 library through version 2.1.3 represents a critical security flaw within the handling of QuickTime chapter metadata structures. Specifically, this issue resides in the GetChapters function, which is responsible for parsing and extracting chapter information from an MP4 container file. The core technical deficiency involves a heap-based out-of-bounds read condition that occurs when processing crafted chapter samples. In standard operation, the library expects the data payload of a chapter sample to align with or exceed the length specified in its metadata header. However, by supplying an MP4 file where the actual byte content of a chapter sample is shorter than the declared title length field, the parser fails to perform adequate bounds checking before attempting to read the string data. This discrepancy allows the application to access memory locations that lie beyond the allocated heap buffer for that specific sample object.
From a technical perspective, this flaw falls under the category of CWE-125, which describes out-of-bounds read vulnerabilities. The attacker exploits this by constructing a malicious MP4 file where the chapter track contains entries with inflated title length fields but truncated actual data payloads. When the GetChapters function executes, it reads characters from memory addresses that are not part of the intended allocation for that specific string buffer. This behavior violates the fundamental principle of memory safety in C and C++ based libraries, leading to undefined behavior depending on what adjacent heap structures contain at runtime. The vulnerability is particularly insidious because MP4 files are commonly used media containers, making them a frequent target for automated fuzzing campaigns or targeted attacks against video processing applications that rely on this library.
The operational impact of this vulnerability is twofold, encompassing both denial of service and potential information disclosure. In the first scenario, if the out-of-bounds read accesses memory regions marked as inaccessible by the operating system's virtual memory manager, it triggers a segmentation fault or access violation. This results in an immediate crash of any application utilizing MP4v2 to parse chapter data, such as dedicated tools like mp4chaps or broader media players that integrate this library for metadata extraction. Such crashes disrupt normal operations and can be leveraged by attackers to cause denial-of-service conditions against services processing untrusted video content. In the second scenario, if the accessed memory regions are valid but contain sensitive information from other heap allocations, the vulnerability enables an arbitrary read primitive. This allows attackers to leak adjacent heap memory contents into chapter titles or log files, potentially exposing cryptographic keys, session tokens, passwords, or internal application state data that were previously stored in nearby buffers before being freed or reallocated.
This type of exploitation aligns with techniques observed in advanced persistent threats and automated exploit frameworks where out-of-bounds reads are used to gather intelligence about the target environment prior to further exploitation steps. It relates closely to ATT&CK technique T1083, which involves file and directory discovery, although here it is specifically applied to memory content rather than filesystem structures. The ability to read arbitrary heap memory can serve as a precursor for more complex attacks, such as information leakage leading to privilege escalation or the bypass of security controls that rely on unpredictable memory layouts like Address Space Layout Randomization if combined with other vulnerabilities.
Mitigation strategies must focus primarily on updating the underlying library infrastructure and implementing robust input validation at the application level. The most effective remediation is to upgrade MP4v2 to a version later than 2.1.3, where developers have presumably implemented proper bounds checking within the GetChapters function to ensure that read operations do not exceed the actual size of the sample data. For applications unable to immediately update their dependencies, defensive programming practices should be adopted during the parsing phase. This includes validating that the declared length of a chapter title does not exceed the remaining bytes in the current chunk or track sample before attempting any string extraction routines. Additionally, integrating fuzzing tools into the continuous integration pipeline can help detect similar boundary condition errors early in the development lifecycle. Security teams should also monitor for anomalous memory access patterns and consider deploying runtime application self-protection mechanisms that can detect out-of-bounds reads and terminate processes safely to prevent information leakage or system instability.