Axomatic Systems Bento4 1.6.0.0 avcC/hvcC configuration atom parsers Create integer underflow

Summaryinfo

A vulnerability classified as problematic was found in Axomatic Systems Bento4 1.6.0.0. The affected element is the function AP4_AvccAtom::Create/AP4_HvccAtom::Create of the component avcC/hvcC configuration atom parsers. Such manipulation leads to integer underflow. This vulnerability is traded as CVE-2026-88377. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Axomatic Systems Bento4 1.6.0.0 and classified as problematic. Affected by this issue is the function AP4_AvccAtom::Create/AP4_HvccAtom::Create of the component avcC/hvcC configuration atom parsers. The manipulation with an unknown input leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is availability. CVE summarizes:

Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination and denial of service.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-88377 since 09/10/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/24/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Multimedia Player Software

Vendor

• Axomatic Systems

Name

• Bento4

Version

• 1.6.0.0

License

• free

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion