Bento4 EUVD-2026-86318

Exploitation requires that a Bento4 1.6.0.0 process parse an attacker-supplied MP4 file containing an avcC or hvcC atom whose declared size is smaller than the atom header size - that specific malformed atom is the trigger for the payload-size underflow in AP4_AvccAtom::Create()/AP4_HvccAtom::Create(). What limits exploitation: the attacker must get the crafted file into a Bento4 parsing path, so impact hinges on deployment - a server auto-ingesting untrusted MP4 uploads is remotely reachable, whereas CLI/manual usage requires an operator to open or process the file (user interaction). Impact is confined to crashing the parsing application (availability only); there is no confidentiality or integrity effect and no code execution.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) treats this as a remote, unauthenticated, no-interaction denial of service, but the underlying flaw is a classic file-parsing crash triggered by processing a specially crafted MP4 file - Bento4 is a library/CLI toolkit, not a listening network service, so AV:N/UI:N only holds when it is embedded in a server that automatically ingests attacker-supplied MP4 uploads. For the common CLI/desktop and batch-tool usage the realistic vector is local with user/operator interaction (AV:L/UI:R), which lowers the practical score to roughly 5.5. Impact is strictly availability (C:N/I:N) - the description states 'application termination,' i.e. a crash of the parsing process, not memory disclosure or code execution, so this is not a code-execution primitive despite being an integer-underflow/heap-copy bug. There is no EPSS score, no CISA KEV listing, and no confirmed public exploit in the provided data, and no SSVC decision values were supplied. Net: this is a genuine but modest-severity DoS whose real priority depends entirely on whether Bento4 is exposed to untrusted MP4 input in an automated pipeline; the headline 7.5 likely overstates risk for typical CLI usage. Note the conflict explicitly: CVSS asserts network/no-interaction, but the description implies local file parsing - verify the deployment context (server-side auto-ingest vs. manual tooling) before prioritizing.

An attacker crafts an MP4 file whose avcC or hvcC atom declares a size smaller than the atom header, then delivers it to a service or user that runs it through Bento4 (e.g. a media transcoding/packaging pipeline accepting uploads). When AP4_AvccAtom::Create() or AP4_HvccAtom::Create() computes the payload size, the value underflows to a huge unsigned number, driving an invalid allocation/copy that terminates the process. No public exploit or PoC is identified in the provided data, though the referenced GitHub issue #1091 may contain a reproducer.