What is the CVSS score of CVE-2026-36908?

CVE-2026-36908 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Bento4 CVE-2026-36908

EUVD-2026-39935 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-26 mitre

GHSA-h2mr-gm7g-c3gr

Buffer Overflow Denial Of Service Stack Overflow N A

5.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

File must be opened by the user (AV:L, UI:R); no privileges needed to open a file (PR:N); impact is crash only with no confidentiality or integrity consequence (C:N, I:N, A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:31 vuln.today

CVSS changed

Jun 29, 2026 - 14:22 NVD

5.5 (MEDIUM)

CVE Published

Jun 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Stack overflow in Bento4's MP4 parsing component allows an attacker to crash any application built on the library by supplying a crafted MP4 file. The flaw resides in AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity, a dynamic array growth function invoked while processing Track Run (trun) atoms, and affects all Bento4 releases before v1.8.9. A public proof-of-concept exists (poc4.zip), though EPSS sits at 0.17% and CISA KEV has not listed this CVE, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

Bento4 is an open-source C++ MP4/ISOBMFF processing toolkit by axiomatic-systems, used in media transcoding pipelines, players (notably MPC-BE per the referenced issue), and command-line utilities such as mp42aac. The vulnerable code path is in the templated AP4_Array class method EnsureCapacity, which reallocates internal storage to hold AP4_TrunAtom::Entry objects - entries within an MPEG-4 Track Run box (trun). CWE-121 (Stack-based Buffer Overflow) indicates that a crafted trun atom can cause the array growth logic to overflow a stack-allocated buffer, corrupting the call stack. Because the overflow occurs during file parsing rather than playback, any tool that opens the file is affected, not just streaming contexts. NVD CPE data is listed as n/a, so affected-version information is drawn from the CVE description (before v1.8.9) and the upstream GitHub issue tracker.

RemediationAI

Upgrade Bento4 to v1.8.9 or later, as stated in the CVE description. Downstream projects embedding Bento4 (e.g., MPC-BE) should rebuild against the patched library version once it is integrated. The upstream fix reference is https://github.com/axiomatic-systems/Bento4/issues/842; a specific commit or patch file is not independently confirmed beyond the issue tracker. As a compensating control where upgrading is not immediately possible, restrict the application's access to untrusted MP4 files - for example, validate or sandbox file ingestion pipelines so that user-supplied media is not parsed by Bento4 directly. Disabling processing of trun-heavy files (e.g., fragmented MP4) via application-layer filters is an option but carries compatibility trade-offs with legitimate streaming formats. No patch is confirmed beyond the stated version threshold; absence of a formal advisory URL from axiomatic-systems means patch verification relies on GitHub issue tracking only.