mp4v2 EUVD-2026-98805

Exploitation requires a victim to open or process an attacker-supplied, specially crafted MP4 file with software linking mp4v2 2.0.0; the file must contain an undersized RTP ('rtp ') atom so that the hint-track code path (MP4RtpAtom::ReadHntiType) performs an offset subtraction that underflows past the atom boundary. Limiting factors: the attack is Local (the malicious file must reach and be parsed on the target system, not delivered over the network to a listening service), it depends on an application actually invoking mp4v2's RTP/hnti parsing, and it affects only the 2.0.0 code path prior to PR #100's position-vs-end bounds check. Despite the input vector's UI:N, realistic exploitation hinges on user/application action to process the file.

Signals are consistently moderate-to-low for mass exploitation risk. The CVSS base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) is driven entirely by High C/I/A impact, not by ease of reach - the Local attack vector means an attacker cannot hit this remotely; a victim user or application must process an attacker-supplied file. EPSS reinforces this: 0.18% probability at the 7th percentile indicates very low predicted exploitation activity, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. A GitHub gist is referenced alongside the issue and fix PR and almost certainly contains a crafted-MP4 reproducer, so publicly available exploit code exists - but this is proof-of-concept material, not confirmation of in-the-wild use. Two signals conflict with the stated vector and should be verified: (1) the input CVSS uses PR:L/UI:N, yet a file-parsing library bug realistically needs no privileges (PR:N) but DOES require the victim to open/process the file (UI:R) - the PR:L/UI:N combination does not match the described attack model; (2) the description claims 'arbitrary code execution,' but the root cause - an unchecked offset subtraction producing a near-2^64 allocation size - most plausibly results in an allocation failure and crash (DoS) rather than reliable RCE; genuine code execution would require the overflow to wrap to a small undersized buffer followed by an out-of-bounds write, which is not demonstrated in the provided data. Net: this is a legitimate but modest-priority memory-safety defect in a niche library, not an urgent internet-facing emergency.

An attacker crafts a malicious MP4 file containing an undersized RTP ('rtp ') atom and delivers it to a victim who opens or processes it with an application built on mp4v2 2.0.0. During hint-track parsing, MP4RtpAtom::ReadHntiType() performs an unchecked offset subtraction that underflows to a near-2^64 size, triggering a massive allocation and memory corruption. A public gist reproducer appears to exist, lowering the effort to trigger the crash, though reliable arbitrary code execution is not independently confirmed.