Bento4 EUVD-2026-86317

Exploitation requires the target to parse a specially crafted MP4 file with Bento4 1.6.0.0 in which an avcC or hvcC configuration atom declares a size smaller than AP4_ATOM_HEADER_SIZE, triggering the underflow in AP4_AvccAtom::Create() or AP4_HvccAtom::Create(). Limiting factors: the attack vector is LOCAL (AV:L), so the malicious file must reach a local parsing path rather than a network-exposed endpoint; impact is confined to a process crash (A:H only, no code execution, data disclosure, or integrity loss); and it applies specifically to code paths that parse H.264 (avcC) or H.265 (hvcC) codec configuration atoms. Realistic exposure is greatest where Bento4 automatically ingests untrusted MP4s (e.g., a transcoding/processing pipeline); where a human must open the file, user interaction is effectively required.

All signals point to a low-to-moderate, availability-only issue rather than an urgent priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) scopes impact strictly to availability (A:H) with no confidentiality or integrity loss - consistent with the description's 'application termination and denial of service' from an integer underflow (CWE-191) in Bento4's avcC/hvcC atom parsers. The attack vector is LOCAL (AV:L), meaning the crafted MP4 must be delivered to and processed by the target rather than reached over a network, which materially limits reach. EPSS is very low (0.15%, 3rd percentile), the CVE is NOT in CISA KEV, and no proof-of-concept exploit is referenced (the sole primary reference is a GitHub issue tracker entry, not exploit code). These signals are mutually consistent: no active exploitation, low predicted exploitation probability, and impact capped at a process crash. Note a minor tension worth verifying: the vector lists PR:N/UI:N yet AV:L, which implies an automated local pipeline ingesting untrusted MP4s; in the common case where a human must open a malicious file, UI:R would be more accurate. There is no version-range clarity - CPE and EUVD both list 'n/a', so only 1.6.0.0 (from the description) is confirmed affected.

An attacker crafts an MP4 file containing an avcC or hvcC configuration atom whose declared size is smaller than AP4_ATOM_HEADER_SIZE, then delivers it to a system or service that parses media with Bento4 1.6.0.0. When AP4_AvccAtom::Create() or AP4_HvccAtom::Create() computes the payload size, the subtraction underflows, producing an oversized buffer operation that passes invalid or NULL pointers into the AP4_DataBuffer copy path and crashes the process. No public exploit code is identified at time of analysis, and exploitation requires the crafted file to reach a local parsing path.