CVE-2026-88377

Deferred Deferred - Pending Action

Integer Underflow in Bento4 MP4 Parser

Publication date: 2026-09-24

Last updated on: 2026-09-29

Assigner: MITRE

Description

Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-29

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-88377

EUVD

EUVD-2026-86317

Affected Vendors & Products

Vendor	Product	Version / Range
bento4		bento4 1.6.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

CVE-2026-88377 is an integer underflow vulnerability in Bento4 1.6.0.0 affecting the avcC and hvcC atom parsers in MP4 files. When an atom's declared size is smaller than the header size (8 bytes), the payload size calculation underflows, causing a large unsigned value. This leads to invalid memory access during buffer copying, resulting in application crashes and denial of service.

Detection Guidance

Detecting this vulnerability requires analyzing MP4 files for malformed avcC or hvcC atoms. Use tools like ffprobe or mediainfo to inspect MP4 files for atom structure anomalies. Check for atoms with declared sizes smaller than 8 bytes, which may indicate the vulnerability. Automated fuzz testing with malformed MP4 files can also help identify crashes.

Impact Analysis

This vulnerability can cause applications using Bento4 to crash consistently when processing malformed MP4 files. It may lead to denial of service by terminating the application and could potentially allow memory corruption if exploited further.

Compliance Impact

The vulnerability causes application termination and denial of service due to integer underflow in MP4 file parsing. This could disrupt systems handling sensitive data, potentially violating compliance requirements for availability in standards like GDPR or HIPAA.

Mitigation Strategies

Update Bento4 to the latest patched version once available. Avoid processing untrusted MP4 files until patched. Implement input validation for atom sizes in MP4 parsers. Use sandboxing or isolation for media processing applications to limit impact of potential crashes.

Hi! I’m here to help you understand CVE-2026-88377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70