CVE-2026-5235

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5235", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-31T14:08:31.340Z", "datePublished": "2026-03-31T22:15:13.447Z", "dateUpdated": "2026-04-01T12:26:03.529Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-31T22:15:13.447Z"}, "title": "Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-122", "lang": "en", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "Axiomatic", "product": "Bento4", "versions": [{"version": "1.6.0-641", "status": "affected"}], "cpes": ["cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*"], "modules": ["MP4 File Parser"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-31T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-31T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-31T16:14:23.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "breakingbad (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/354386", "name": "VDB-354386 | Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354386/cti", "name": "VDB-354386 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780472", "name": "Submit #780472 | Bento4 <=1.6.0-641 Memory Corruption", "tags": ["third-party-advisory"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1058", "tags": ["issue-tracking"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1058#issue-4078583078", "tags": ["exploit", "issue-tracking"]}], "tags": ["x_freeware"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T12:25:12.265664Z", "id": "CVE-2026-5235", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T12:26:03.529Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5235", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T12:25:12.265664Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T12:25:57.730Z"}}], "cna": {"tags": ["x_freeware"], "title": "Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow", "credits": [{"lang": "en", "type": "reporter", "value": "breakingbad (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*"], "vendor": "Axiomatic", "modules": ["MP4 File Parser"], "product": "Bento4", "versions": [{"status": "affected", "version": "1.6.0-641"}]}], "timeline": [{"lang": "en", "time": "2026-03-31T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-31T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-31T16:14:23.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354386", "name": "VDB-354386 | Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354386/cti", "name": "VDB-354386 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780472", "name": "Submit #780472 | Bento4 <=1.6.0-641 Memory Corruption", "tags": ["third-party-advisory"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1058", "tags": ["issue-tracking"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1058#issue-4078583078", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-31T22:15:13.447Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5235", "state": "PUBLISHED", "dateUpdated": "2026-04-01T12:26:03.529Z", "dateReserved": "2026-03-31T14:08:31.340Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-31T22:15:13.447Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*"], "modules": ["MP4 File Parser"], "product": "Bento4", "vendor": "Axiomatic", "versions": [{"status": "affected", "version": "1.6.0-641"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad fue determinada en Axiomatic Bento4 hasta 1.6.0-641. Esto afecta la funci\u00f3n AP4_BitReader::ReadCache del archivo Ap4Dac4Atom.cpp del componente MP4 File Parser. Esta manipulaci\u00f3n causa desbordamiento de b\u00fafer basado en mont\u00edculo. El ataque necesita ser lanzado localmente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero a\u00fan no ha respondido."}], "id": "CVE-2026-5235", "lastModified": "2026-06-17T10:58:39.097", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5235", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T12:25:12.265664Z", "version": "2.0.3"}}]}, "published": "2026-03-31T23:17:11.163", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/axiomatic-systems/Bento4/issues/1058"}, {"source": "cna@vuldb.com", "url": "https://github.com/axiomatic-systems/Bento4/issues/1058#issue-4078583078"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780472"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354386"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354386/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-122"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.6.0-641"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Bento4", "source": "cna", "vendor": "Axiomatic"}, "product": "bento4", "vendor": "axiomatic"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.0-641]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "bento4", "vendor": "bento4"}], "analysis": {"en": {"generated_at": "2026-04-01T06:55:53.949071+00:00", "value": {"mitigation_remediation": ["Verify whether a new version of Bento4 is available; upgrade to a release newer than 1.6.0\u2011641 if possible.", "Limit Bento4 execution to trusted users and run it with the least privileges necessary.", "Monitor systems for crashes or abnormal behavior that might indicate exploitation of the MP4 parser.", "Contact Axiomatic for an official patch or detailed guidance if a newer release is not yet available."], "summary": {"action": "Assess Impact", "impact": "Local heap-based buffer overflow in Bento4 MP4 file parser"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of Axiomatic Bento4 up to version 1.6.0\u2011641. This includes any installations that use the Bento4 MP4 processing library distributed by Axiomatic. No other vendors or product versions are listed.", "description_and_impact": "A heap-based buffer overflow occurs in the AP4_BitReader::ReadCache function within the Ap4Dac4Atom.cpp component of Bento4. The flaw allows crafted MP4 input to overwrite heap memory, potentially corrupting program state and causing crashes or other unpredictable behavior. The CVE documentation does not assert that the overflow necessarily leads to arbitrary code execution, only that it can be exploited when the application processes an attacker\u2011controlled MP4 file.", "risk_and_exploitability": "The CVSS score of 4.8 indicates a moderate severity. Exploitation requires local access to the system running the vulnerable Bento4 binary; remote exploitation is not described. The vulnerability has been publicly disclosed, and an exploit may be utilized locally, but it is not currently listed in the CISA KEV catalog and the EPSS score is unavailable. The risk is primarily a local privilege escalation or stability issue for systems that run Bento4 under potentially untrusted contexts."}}}}, "created": "2026-04-02T07:51:45.607058+00:00", "updated": "2026-04-02T20:10:05.604047+00:00", "vendors": ["axiomatic", "axiomatic$PRODUCT$bento4", "bento4", "bento4$PRODUCT$bento4"]}