Is there a public PoC exploit available for CVE-2026-5235?

Yes, a public proof-of-concept exploit is available for CVE-2026-5235. Prioritise patching immediately. EPSS: 0.0%.

Bento4 CVE-2026-5235

Q: What is the CVSS score of CVE-2026-5235?

CVE-2026-5235 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17725 LOW

Heap-based Buffer Overflow (CWE-122)

2026-03-31 VulDB

Heap Overflow Buffer Overflow Bento4

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 01, 2026 - 14:23 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 22:32 euvd

EUVD-2026-17725

Analysis Generated

Mar 31, 2026 - 22:32 vuln.today

CVE Published

Mar 31, 2026 - 22:15 nvd

MEDIUM 4.8

DescriptionCVE.org

A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Heap-based buffer overflow in Axiomatic Bento4 up to version 1.6.0-641 affects the AP4_BitReader::ReadCache function in the MP4 file parser component, allowing local attackers with limited privileges to cause information disclosure, integrity violation, and denial of service. Publicly available exploit code exists, and the vendor has not yet responded to the early disclosure despite project notification through GitHub issue tracking.

Technical ContextAI

The vulnerability resides in the MP4 file parser component of Bento4, specifically in the Ap4Dac4Atom.cpp file's AP4_BitReader::ReadCache function. This represents a classic heap-based buffer overflow (CWE-122: Heap-based Buffer Overflow), where improper bounds checking during bitstream reading operations allows writing beyond allocated heap memory. Bento4 is a C++ library for reading and writing digital media files in the ISOM/MP4 format, commonly used in multimedia processing pipelines. The affected CPE range (cpe:2.3:a:axiomatic:bento4:*:*:*:*:*:*:*:*) indicates all versions up to 1.6.0-641 are vulnerable to this memory safety violation.

RemediationAI

Upgrade Axiomatic Bento4 to a version newer than 1.6.0-641 once the vendor releases a patched version; no vendor-released patch has been independently confirmed at time of analysis. As an interim mitigation, restrict access to Bento4 processing functions to trusted sources only, avoid processing untrusted MP4 files with vulnerable versions, and consider sandboxing or containerizing Bento4 usage to limit the blast radius of potential heap corruption. Monitor the official GitHub repository (https://github.com/axiomatic-systems/Bento4/issues/1058) and VulDB (https://vuldb.com/vuln/354386) for vendor response and patch availability.