What is the CVSS score of CVE-2026-36907?

CVE-2026-36907 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Bento4 CVE-2026-36907

EUVD-2026-39934 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-26 mitre

GHSA-7xhj-grfg-56xm

Buffer Overflow Denial Of Service Stack Overflow N A

5.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

File-based attack requires no privileges or network access (AV:L, PR:N), but a user must open the crafted MP4 (UI:R); impact is crash-only with no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:13 vuln.today

CVE Published

Jun 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Stack-based overflow in Bento4's MP4 sample-description atom parser (AP4_StsdAtom) crashes any application that processes a specially crafted MP4 file, resulting in Denial of Service. Versions before v1.8.9 of the axiomatic-systems library are affected; the fix was introduced in v1.8.9. A proof-of-concept has been confirmed by SSVC analysis, though EPSS sits at just 0.17% (7th percentile), indicating no significant observed exploitation activity at time of analysis.

Technical ContextAI

Bento4 is a C++ toolkit for reading, writing, and converting MP4/ISOBMFF media files, used in a variety of media processing applications including MPC-BE (as evidenced by the cross-referenced GitHub issue https://github.com/Aleksoid1978/MPC-BE/issues/1005). The vulnerable component is AP4_StsdAtom, the constructor that parses the 'stsd' (Sample Description) box in the MP4 container format. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: when parsing a malformed or adversarially crafted stsd atom, the constructor writes beyond the bounds of a stack-allocated buffer, corrupting the stack frame and causing an uncontrolled crash. Because this occurs in the file-parsing layer, any tool or application linking against the affected Bento4 version and parsing untrusted MP4 files is exposed. The CPE data provided (cpe:2.3:a:n/a:n/a) is non-descriptive and offers no additional version resolution beyond what the description supplies.

RemediationAI

Upgrade Bento4 to version v1.8.9 or later, which resolves the stack overflow in AP4_StsdAtom. The upstream issue tracking this vulnerability is at https://github.com/axiomatic-systems/Bento4/issues/614. Downstream consumers such as MPC-BE should track the corresponding fix at https://github.com/Aleksoid1978/MPC-BE/issues/1005 and update to a build that incorporates the patched Bento4 version. Where an immediate upgrade is not feasible, the primary compensating control is to restrict which files can be processed: reject or quarantine MP4 files from untrusted sources before they reach any Bento4-based parser. If Bento4 is used in a media processing service, sandboxing the parsing process (e.g., via seccomp, containers, or process isolation) limits the blast radius of a crash to the parsing subprocess rather than the broader application. Disabling MP4 processing entirely is a complete mitigation with the obvious trade-off of losing MP4 support.