CVE-2026-5236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5236", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-31T14:08:36.184Z", "datePublished": "2026-03-31T23:00:19.377Z", "dateUpdated": "2026-04-03T16:39:04.400Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-31T23:00:19.377Z"}, "title": "Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-122", "lang": "en", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "Axiomatic", "product": "Bento4", "versions": [{"version": "1.6.0-641", "status": "affected"}], "cpes": ["cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*"], "modules": ["DSI v1 Parser"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-31T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-31T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-31T16:14:33.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "breakingbad (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/354387", "name": "VDB-354387 | Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354387/cti", "name": "VDB-354387 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780473", "name": "Submit #780473 | Bento4 <=1.6.0-641 Memory Corruption", "tags": ["third-party-advisory"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1059", "tags": ["issue-tracking"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1059#issue-4078584738", "tags": ["exploit", "issue-tracking"]}], "tags": ["x_freeware"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T16:38:35.489093Z", "id": "CVE-2026-5236", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T16:39:04.400Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5236", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T16:38:35.489093Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T16:38:50.479Z"}}], "cna": {"tags": ["x_freeware"], "title": "Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow", "credits": [{"lang": "en", "type": "reporter", "value": "breakingbad (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*"], "vendor": "Axiomatic", "modules": ["DSI v1 Parser"], "product": "Bento4", "versions": [{"status": "affected", "version": "1.6.0-641"}]}], "timeline": [{"lang": "en", "time": "2026-03-31T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-31T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-31T16:14:33.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354387", "name": "VDB-354387 | Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354387/cti", "name": "VDB-354387 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780473", "name": "Submit #780473 | Bento4 <=1.6.0-641 Memory Corruption", "tags": ["third-party-advisory"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1059", "tags": ["issue-tracking"]}, {"url": "https://github.com/axiomatic-systems/Bento4/issues/1059#issue-4078584738", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-31T23:00:19.377Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5236", "state": "PUBLISHED", "dateUpdated": "2026-04-03T16:39:04.400Z", "dateReserved": "2026-03-31T14:08:36.184Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-31T23:00:19.377Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:bento4:bento4:*:*:*:*:*:*:*:*"], "modules": ["DSI v1 Parser"], "product": "Bento4", "vendor": "Axiomatic", "versions": [{"status": "affected", "version": "1.6.0-641"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en Axiomatic Bento4 hasta la versi\u00f3n 1.6.0-641. Se ve afectada la funci\u00f3n AP4_BitReader::SkipBits del archivo Ap4Dac4Atom.cpp del componente DSI v1 Parser. Dicha manipulaci\u00f3n del argumento n_presentations conduce a un desbordamiento de b\u00fafer basado en mont\u00edculo. El ataque debe realizarse localmente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-5236", "lastModified": "2026-06-17T10:58:39.247", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5236", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T16:38:35.489093Z", "version": "2.0.3"}}]}, "published": "2026-03-31T23:17:11.393", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/axiomatic-systems/Bento4/issues/1059"}, {"source": "cna@vuldb.com", "url": "https://github.com/axiomatic-systems/Bento4/issues/1059#issue-4078584738"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780473"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354387"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354387/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-122"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.6.0-641"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Bento4", "source": "cna", "vendor": "Axiomatic"}, "product": "bento4", "vendor": "axiomatic"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.0-641]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "bento4", "vendor": "bento4"}], "analysis": {"en": {"generated_at": "2026-04-01T06:32:21.435996+00:00", "value": {"mitigation_remediation": ["Verify whether a newer release of Bento4 that resolves this issue is available and upgrade immediately.", "If no patch exists, run Bento4 with the least privilege necessary and restrict local access to trusted users only.", "Monitor system logs for abnormal crashes or segmentation faults that may indicate an attempted buffer overflow.", "Apply future official security updates from Axiomatic as soon as they are released.", "Consider sandboxing or containerizing Bento4 to contain potential memory corruption."], "summary": {"action": "Assess Impact", "impact": "Local heap-based buffer overflow"}, "threat_synthesis": {"affected_systems": "All users running Axiomatic Bento4 versions up to and including 1.6.0\u2011641 are affected, as identified in the vendor\u2019s issue report. No further versions are explicitly listed, so releases after 1.6.0\u2011641 should be safe until an official update is confirmed.", "description_and_impact": "The vulnerability exists in the AP4_BitReader::SkipBits function of the Ap4Dac4Atom.cpp file in Bento4\u2019s DSI v1 Parser module. Manipulating the n_presentations argument can trigger a heap\u2011based buffer overflow, potentially corrupting memory, causing the application to crash, or enabling overwriting of executable data. This weakness aligns with CWE\u2011119 (Improper Handling of Buffer Size) and CWE\u2011122 (Heap-based Buffer Overflow). While the exploit requires local access to the Bento4 process, the resulting memory corruption could lead to denial of service or, in rare cases, local privilege escalation if an attacker can inject executable payloads.", "risk_and_exploitability": "The CVSS base score is 4.8, indicating moderate severity, and no EPSS data is provided. The vulnerability has not been catalogued in CISA\u2019s KEV database. Attackers must have local access to the Bento4 process to manipulate the SkipBits argument; however, publicly available exploit code demonstrates that the attack can be automated once local control is achieved. Because no official patch has been released, the risk remains until an update or mitigation is applied."}}}}, "created": "2026-04-02T07:51:38.731528+00:00", "updated": "2026-04-02T20:09:58.383728+00:00", "vendors": ["axiomatic", "axiomatic$PRODUCT$bento4", "bento4", "bento4$PRODUCT$bento4"]}