CVE-2022-40738

Name of the Vulnerable Software and Affected Versions Bento4 versions 1.6.0-639 and earlier

Description An issue was discovered that leads to a NULL pointer dereference in AP4 DescriptorListWriter::Action in Core/Ap4Descriptor.h. This issue is called from AP4 EsDescriptor::WriteFields and AP4 Expandable::Write.

Recommendations For Bento4 versions 1.6.0-639 and earlier, consider disabling the AP4 DescriptorListWriter::Action function as a temporary workaround until a patch is available. Restrict access to the Core/Ap4Descriptor.h module to minimize the risk of exploitation. Avoid using the affected functions AP4 EsDescriptor::WriteFields and AP4 Expandable::Write until the issue is resolved.