CVE-2024-30807: Axiosys Bento4 Use-After-Free Vulnerability

CVE-2024-30807 Overview

CVE-2024-30807 is a heap use-after-free vulnerability in Bento4 version 1.6.0-641-2-g1529b83, an open-source toolkit for parsing MP4 and related media containers. The flaw resides in the AP4_UnknownAtom::~AP4_UnknownAtom destructor located in Ap4Atom.cpp. An attacker can trigger the condition by supplying a crafted media file processed by Bento4 utilities such as mp42ts, leading to a denial of service. The issue is tracked under [CWE-416: Use After Free].

Critical Impact
Processing a malicious MP4 file with Bento4 crashes the application, disrupting any automated media workflow that ingests untrusted input.

Affected Products

Axiosys Bento4 1.6.0-641-2-g1529b83
Bento4 command-line tools including mp42ts
Downstream projects bundling vulnerable Bento4 libraries

Discovery Timeline

2024-04-02 - CVE-2024-30807 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30807

Vulnerability Analysis

The vulnerability is a heap use-after-free in the destructor AP4_UnknownAtom::~AP4_UnknownAtom within Bento4's atom parsing code. Bento4 represents MP4 box structures as AP4_Atom objects; unknown atom types are instantiated as AP4_UnknownAtom to preserve their payload. When a malformed file forces the parser through an inconsistent ownership path, memory referenced by the destructor has already been freed elsewhere in the object graph.

The mp42ts utility, which converts MP4 input into MPEG-2 Transport Stream, exercises this path during teardown of parsed atoms. The result is access to freed heap memory and termination of the process. While the vendor advisory limits the documented impact to denial of service, use-after-free conditions can occasionally be escalated depending on heap layout and allocator behavior.

Root Cause

The root cause is improper lifetime management of buffer memory owned by AP4_UnknownAtom instances. The destructor dereferences or frees a pointer that has already been released by another code path during parsing of a crafted atom hierarchy. This violates single-ownership semantics for the underlying heap allocation [CWE-416].

Attack Vector

Exploitation requires the victim or an automated pipeline to process an attacker-supplied MP4 file using a vulnerable Bento4 binary. No authentication or user interaction beyond opening the file is required. Network exposure occurs when Bento4 is integrated into transcoding services, content delivery pipelines, or upload-handling backends that accept untrusted media. Details of the proof-of-concept are documented in the Bento4 GitHub Issue #937 and the CVE-2024-30807 reference repository.

Detection Methods for CVE-2024-30807

Indicators of Compromise

Unexpected crashes or SIGABRT/SIGSEGV terminations of mp42ts, mp4info, or other Bento4 binaries during media ingestion.
AddressSanitizer reports of heap-use-after-free originating in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp.
MP4 files containing malformed or oversized unknown atom types submitted to transcoding pipelines.

Detection Strategies

Inventory hosts and containers for Bento4 binaries matching version 1.6.0-641-2-g1529b83 or earlier using software composition analysis.
Run Bento4 under sanitizers (ASan, UBSan) in pre-production to surface use-after-free behavior on suspect inputs.
Monitor process exit codes and core dumps from media processing services to flag repeated abnormal terminations.

Monitoring Recommendations

Alert on repeated crashes of Bento4 worker processes within short time windows, which may indicate active exploitation attempts.
Capture file hashes of MP4 inputs that trigger crashes and add them to internal block lists.
Forward Bento4 stderr and core dump metadata into centralized logging for correlation with upload sources.

How to Mitigate CVE-2024-30807

Immediate Actions Required

Upgrade Bento4 to a build that includes the fix referenced in Bento4 GitHub Issue #937, or apply vendor patches if available.
Isolate media transcoding workloads in sandboxed containers with strict resource limits and automatic restart policies.
Restrict the set of users and services authorized to submit MP4 content into pipelines that invoke mp42ts.

Patch Information

No formal vendor advisory URL is published in the NVD record. Track upstream commits and releases in the axiomatic-systems/Bento4 repository for the fix addressing the AP4_UnknownAtom destructor. Rebuild any internal tools that statically link Bento4 after applying the corrected source.

Workarounds

Disable or remove mp42ts and related Bento4 utilities from servers that accept untrusted media until patched binaries are deployed.
Pre-validate uploaded MP4 files with an independent parser that rejects malformed atom structures before handing them to Bento4.
Run Bento4 binaries as a low-privilege service account inside an ephemeral container that is terminated after each job.

bash

# Example: confine mp42ts inside a non-privileged, read-only container
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=none \
  --memory=512m --pids-limit=64 \
  -v /srv/media/in:/in:ro \
  -v /srv/media/out:/out \
  bento4:patched mp42ts /in/input.mp4 /out/output.ts