EUVD-2026-98803
GHSA-wxhq-x7fc-42gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted MP4 to mp4v2 consumer
-
ExploitParser reaches GenerateTracks() handler check
-
ExecutionNULL from GetValue() passed to strcmp
-
ImpactProcess crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application that uses mp4v2 2.0.0 to parse an attacker-supplied MP4 file containing a track whose handler-type property yields a NULL value from GetValue(), which MP4File::GenerateTracks() then passes unchecked to strcmp(). Limiting factors: impact is confined to a process crash (availability only, no code execution or data exposure); it is only reachable if the crafted file is actually fed to the vulnerable parser. In automated server-side pipelines that ingest untrusted MP4s this is remote/unauthenticated; in interactive client use it effectively requires the user to open the malicious file, reducing real-world reach. Not exploitable against versions that include the PR #101 NULL-check fix. |
| Impact | Signals are internally consistent and point to a genuine but bounded availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 7.5 purely on A:H with C:N/I:N - this is a pure denial-of-service (NULL pointer dereference / crash), not code execution, so the 'High' rating overstates business impact for many deployments. SSVC reinforces this: Exploitation=poc (not active), Automatable=yes, Technical Impact=partial (a crash, not full takeover). A public POC exists (gist + upstream issue #99), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or active exploitation. Conflict to verify: mp4v2 is a file-parsing LIBRARY, so the AV:N/UI:N rating assumes an application auto-processes attacker-supplied MP4 files (e.g., a server-side transcoder or media pipeline); in desktop/client contexts a user would have to open the malicious file, which is closer to UI:R and lowers real-world severity. Net: treat as a moderate-priority hardening fix, not an emergency - prioritize only where mp4v2 2.0.0 parses untrusted MP4 input in an automated or exposed path. |
| Exploit ScenarioDerived | An attacker crafts a malformed MP4 whose track atom causes the handler-type property's GetValue() to return NULL; an application built on mp4v2 2.0.0 parses the file and MP4File::GenerateTracks() passes that NULL into strcmp(), dereferencing it and crashing the process. A proof-of-concept is publicly referenced (upstream issue #99 and a gist), and because parsing is automatable, repeated submission of the crafted file reliably denies service. Impact is limited to a crash - no confidentiality or integrity loss. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in mp4v2 2.0.0 lets a remote, unauthenticated attacker crash any process that parses an attacker-supplied MP4 file, because MP4File::GenerateTracks() in src/mp4file.cpp passes a NULL handler-type string straight into strcmp() without a check (CWE-476). Impact is availability-only - no code execution, privilege escalation, or data exposure - but the defect is trivially automatable (CISA SSVC: automatable yes, technical impact partial) and publicly available exploit code exists, with no CISA KEV designation. EPSS and NVD enrichment were not provided in the available data, so no quantitative exploit-likelihood score is asserted here. In server-side pipelines that ingest untrusted MP4s the exposure is genuinely remote and unauthenticated; for interactive clients it reduces to a user opening a malicious file.
RemediationAI
No vendor-tagged patched release was confirmed in the provided data; the available fix is upstream code - pull request https://github.com/TechSmith/mp4v2/pull/101, commit b5df7f39d741d8926da1ac80fa8c579c30686e7f, which adds a NULL check on the handler-type value before strcmp() in MP4File::GenerateTracks() and hardens the misaligned atom-string accesses in mp4util.cpp. Treat this as an upstream fix (PR/commit) and either cherry-pick that commit onto your pinned 2.0.0 tree and rebuild, or track the project for a tagged release that includes it; rebuilding is required because this is a compiled library, so vendored copies and bundled dependencies must be recompiled, not merely relinked. Until the fix is deployed, compensating controls that actually reduce exposure: run every MP4-parsing worker in a sandboxed, unprivileged, resource-capped process (separate UID or container, memory limits, and an OOM-aware supervisor) and treat any crash as a contained availability event rather than a host failure - the trade-off is added operational complexity and per-request overhead. Where untrusted media is not essential, disable or reject MP4 ingestion and metadata/thumbnail generation on the affected code path entirely, or gate it behind an allowlist of known-good sources. For upload pipelines, apply strict pre-ingestion validation and size/complexity caps on container atoms before handing files to mp4v2, and rate-limit or queue-buffer parsing requests so that a crash cannot translate into broad service unavailability - note that these are heuristics, not soundness checks, and a syntactically valid file can still trigger the dereference. Monitor the GitHub issue and NVD links above for a fixed release, and note that patch data from the vendor should be re-verified rather than assumed; absence of a tagged release here is not confirmation that no patch exists.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mp4v2 is a C++ library for reading, writing, and manipulating MP4/ISO base media container files, and the defect lives in its track-generation logic. While walking the parsed atom tree, MP4File::GenerateTracks() retrieves the handler-type property associated with a track (the 'hdlr' atom payload) and compares it against MP4_HINT_TRACK_TYPE using strcmp(). If the property lookup or conversion yields a NULL pointer - as it can for a crafted or truncated handler-type value - the unchecked dereference crashes the process. This is a textbook CWE-476 NULL pointer dereference: the root cause is a missing validity check on a value returned by the parser layer rather than a memory-safety error such as a buffer overflow, which is why the CVSS vector scores C:N/I:N/A:H with no confidentiality or integrity impact. The accompanying upstream patch touches a second, related issue in src/mp4util.cpp: string atoms are not guaranteed to be 4-byte aligned, so atomic integer reads/writes (MP4V2_NTOHL / MP4V2_HTONL) were previously performed through a directly cast pointer under the MP4V2_INTSTRING_ALIGNMENT conditional, which is undefined behaviour on architectures with strict alignment; the fix always copies through a local variable. The reported CPE string is a placeholder (cpe:2.3:a:n/a:n/a), and the EUVD affected-version record also reads 'n/a n/a', so version scoping rests on the CVE description, which names mp4v2 2.0.0 specifically. The upstream fix is available as a pull request and a specific commit.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafted file parsed by a library with no auth (PR:N) causes a reliable crash (A:H) and no C/I impact; AV:N/UI:N holds for automated ingestion, though client-side use would be closer to UI:R.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
Executive ViewAI
mp4v2 2.0.0 carries a high-severity availability flaw that can crash applications processing MP4 files, threatening continuity of media ingestion pipelines and any interactive workflow that opens untrusted MP4s. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, so affected teams must rely on containment while monitoring for service disruptions.
No vendor-released patch identified at time of analysis; interim mitigations include disabling MP4 parsing or rejecting untrusted MP4 inputs in mp4v2 2.0.0, isolating MP4-processing services in sandboxed or containerized environments with process limits and auto-restart, restricting uploads to trusted sources, using an alternative hardened MP4 parser or pre-validating files, and monitoring for process crashes until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB