Axiomatic Bento4 CVE-2026-5236

Q: What is the CVSS score of CVE-2026-5236?

CVE-2026-5236 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17729 LOW

Buffer Overflow (CWE-119)

2026-03-31 cna@vuldb.com

GHSA-9jwv-5qpr-m876

Buffer Overflow

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

EUVD ID Assigned

Mar 31, 2026 - 23:22 euvd

EUVD-2026-17729

Analysis Generated

Mar 31, 2026 - 23:22 vuln.today

CVE Published

Mar 31, 2026 - 23:17 nvd

MEDIUM 4.8

DescriptionCVE.org

A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Heap-based buffer overflow in Axiomatic Bento4 up to version 1.6.0-641 allows local authenticated attackers to cause a denial of service or potentially corrupt memory via the AP4_BitReader::SkipBits function in the DSI v1 Parser component when processing a maliciously crafted n_presentations argument. Public exploit code is available; vendor has not responded to early disclosure.

Technical ContextAI

The vulnerability resides in the AP4_BitReader::SkipBits function within Ap4Dac4Atom.cpp, which handles parsing of ISO Base Media File Format (ISOBMFF) DAC4 atoms used for Digital Audio Codec 4 (DAC4) metadata. The DSI v1 (Decoder Specific Information) parser fails to properly validate the n_presentations parameter before using it in buffer operations, allowing an attacker to skip an excessive number of bits and read or write beyond allocated heap memory boundaries. This is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Bento4 is a widely-used C++ toolkit for ISOBMFF file manipulation, commonly embedded in media players, transcoding pipelines, and content distribution systems.

RemediationAI

Upgrade Axiomatic Bento4 to a version newer than 1.6.0-641 once the vendor releases a patched version. Monitor the Bento4 GitHub repository (https://github.com/axiomatic-systems/Bento4) and the reported issue (#1059) for vendor updates. Until a patch is available, apply input validation to reject malformed DAC4 atoms with suspicious n_presentations values before passing them to the AP4_BitReader::SkipBits function, or disable DAC4 parsing in applications that do not require DAC4 support. For applications that must process untrusted media files, run file processing in a sandboxed environment with restricted local access to limit the blast radius of heap corruption.