CVE-2024-58397

Received Received - Intake

Heap-based Out-of-Bounds Read in MP4v2

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2024-58397

Affected Vendors & Products

Vendor	Product	Version / Range
enzo1982	mp4v2	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based out-of-bounds read in MP4v2 through version 2.1.3. It occurs in the MP4File::GetChapters() function when processing QuickTime chapter samples. Attackers can create an MP4 file with a chapter sample shorter than its declared title length, causing applications like mp4chaps to crash or leak adjacent heap memory into chapter titles.

Detection Guidance

This vulnerability can be detected by analyzing MP4 files for malformed chapter samples. Use tools like mp4chaps to parse MP4 files and check for crashes or unexpected output when processing chapter data. Examine files with QuickTime chapter samples for mismatches between declared title length and actual sample size.

Impact Analysis

This vulnerability can crash applications that process MP4 files with malformed chapter samples, such as mp4chaps. It may also expose sensitive data by leaking adjacent heap memory into chapter titles, potentially revealing information not intended for disclosure.

Mitigation Strategies

Immediately update MP4v2 to the latest patched version if available. Avoid processing untrusted MP4 files, especially those with QuickTime chapter samples. Implement file validation checks before processing MP4 files in applications. Monitor for crashes in applications like mp4chaps as potential indicators of exploitation.

Hi! I’m here to help you understand CVE-2024-58397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70