CVE-2018-20186

Name of the Vulnerable Software and Affected Versions Bento4 version 1.5.1-627

Description An issue was discovered that allows attackers to trigger an attempted excessive memory allocation. This is related to the AP4 DataBuffer::SetDataSize and AP4 DataBuffer::ReallocateBuffer functions in Core/Ap4DataBuffer.cpp, which are used by the AP4 Sample::ReadData function in Core/Ap4Sample.cpp.

Recommendations For Bento4 version 1.5.1-627, consider restricting the use of the AP4 Sample::ReadData function until a patch is available to prevent excessive memory allocation attempts.