CVE-2026-105273
Received Received - Intake

MP4 Box Size Validation Flaw in MP4Parser

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: ICS-CERT

Description
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-105273
EUVD
EUVD-2026-102892

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
J4Care dcm4chee-arc-light 5.35.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MP4Parser has a flaw where it fails to properly validate the size of MP4 boxes. This allows a maliciously crafted box to cause the parser to get stuck in an infinite loop, repeatedly processing the same data without making progress.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed MP4 files that cause parsing loops. Check logs for applications using MP4Parser for repeated processing of the same input. Use file inspection tools like 'file' or 'ffprobe' to analyze suspicious MP4 files for abnormal box sizes or structures.

Impact Analysis

This vulnerability can lead to denial-of-service conditions where applications using MP4Parser hang or crash when processing malicious MP4 files. It may also allow attackers to consume excessive system resources.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service conditions through malformed MP4 files. GDPR requires data integrity and availability, while HIPAA mandates protection against unauthorized access or disruptions. Repeated processing of malformed input may lead to system instability, affecting availability and integrity of data processing systems.

Mitigation Strategies

Immediately update MP4Parser to the latest patched version. If unavailable, restrict processing of MP4 files to trusted sources only. Implement input validation to reject files with suspiciously large or malformed box sizes. Monitor system logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart