CVE-2026-88377

Name of the Vulnerable Software and Affected Versions Bento4 version 1.6.0.0

Description An integer underflow exists in the avcC and hvcC configuration atom parsers. When processing a specially crafted MP4 file where an atom has a declared size smaller than AP4 ATOM HEADER SIZE, the functions AP4 AvccAtom::Create() or AP4 HvccAtom::Create() may underflow the payload-size calculation. This leads to an oversized buffer operation that can pass invalid or NULL pointers to the AP4 DataBuffer copy path, causing the application to terminate and resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.