Axiomatic Bento4 1.6.0-641 MP4 File Ap4RtpAtom.cpp AP4_RtpAtom::AP4_RtpAtom buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4 1.6.0-641. This affects the function AP4_RtpAtom::AP4_RtpAtom of the file Ap4RtpAtom.cpp of the component MP4 File Handler. This manipulation causes buffer overflow. This vulnerability appears as CVE-2025-25944. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Axiomatic Bento4 1.6.0-641. Affected by this vulnerability is the function AP4_RtpAtom::AP4_RtpAtom of the file Ap4RtpAtom.cpp of the component MP4 File Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RtpAtom, during the execution of mp4fragment with a crafted MP4 input file.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-25944 since 02/07/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/01/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-4599). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Multimedia Player Software

Vendor

• Axiomatic

Name

• Bento4

Version

• 1.6.0-641

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion