CVE-2024-57513 Overview
CVE-2024-57513 is a floating-point exception (FPE) vulnerability in the AP4_TfraAtom::AP4_TfraAtom constructor within Bento4, an open-source C++ toolkit for parsing and processing MP4 media files. The flaw is triggered when a specially crafted MP4 file containing a malformed Track Fragment Random Access (tfra) atom is processed. Successful exploitation causes the parsing process to terminate abnormally, resulting in a denial-of-service condition. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input).
Critical Impact
A remote attacker can crash any application or automated pipeline that uses Bento4 to parse untrusted MP4 files, disrupting media processing workflows.
Affected Products
- Bento4 (axiomatic-systems/Bento4) MP4 toolkit
- Applications and services embedding Bento4 for MP4 parsing
- Automated media transcoding and analysis pipelines using Bento4
Discovery Timeline
- 2025-01-29 - CVE-2024-57513 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-57513
Vulnerability Analysis
The vulnerability resides in the AP4_TfraAtom constructor, which parses the Track Fragment Random Access Box (tfra) inside the Movie Fragment Random Access Box (mfra) of an MP4 container. The tfra atom stores random-access metadata used to seek within fragmented MP4 media. During parsing, the constructor performs arithmetic operations on values extracted directly from the atom header without adequately validating them. An attacker who supplies a malformed atom can force a divide-by-zero or comparable floating-point exception, terminating the process.
Exploitation requires user interaction, since a victim must open or process the attacker-supplied MP4 file. The impact is limited to availability: no confidentiality or integrity loss occurs. Further technical details are available in the GitHub Issue #990 Discussion and the GitHub Gist PoC Repository. EPSS data places exploitation probability at 0.313%.
Root Cause
The root cause is missing input validation for size and count fields inside the tfra atom before they are used in arithmetic operations. Fields describing the number of entries or entry sizes are consumed without range checks, allowing crafted values to reach code paths that trigger a hardware-level floating-point exception.
Attack Vector
The attack vector is network-based delivery of a malicious MP4 file. An attacker hosts or emails a crafted file, or submits it to a service that parses MP4 using Bento4. When the file is opened, parsing reaches AP4_TfraAtom::AP4_TfraAtom, and the process aborts. No authentication is required. Refer to the GitHub Gist PoC Repository for a proof-of-concept sample.
Detection Methods for CVE-2024-57513
Indicators of Compromise
- Unexpected termination of mp4info, mp4dump, or other Bento4-based utilities during MP4 parsing
- Core dumps or SIGFPE signals originating from Bento4 process memory regions
- Batch media processing jobs failing on specific input files with parser exit codes
Detection Strategies
- Inspect MP4 files for tfra atoms containing zero or malformed entry-size and entry-count fields prior to parsing
- Monitor host telemetry for repeated SIGFPE crashes tied to Bento4 binaries or linked libraries
- Deploy fuzz-hardened wrappers or sandboxes around media parsers and log all abnormal exits
Monitoring Recommendations
- Enable crash reporting on all servers running Bento4-based conversion or ingestion pipelines
- Alert on repeated parser failures from the same source IP or uploader identity
- Correlate MP4 upload activity with subsequent process crashes in centralized logs
How to Mitigate CVE-2024-57513
Immediate Actions Required
- Inventory all internal tools, services, and containers that link against Bento4 or ship its command-line utilities
- Restrict processing of MP4 files from untrusted sources until a patched build is deployed
- Run Bento4 parsing workloads inside sandboxes or restricted-privilege containers that recover automatically from crashes
Patch Information
No official vendor patch is referenced in the CVE record at the time of publication. Track the GitHub Issue #990 Discussion for upstream fix status, and rebuild or upgrade Bento4 from the axiomatic-systems/Bento4 repository once a corrected release is available.
Workarounds
- Pre-validate MP4 files with a hardened parser and reject files containing malformed mfra/tfra atoms
- Isolate Bento4 execution in a separate process with automatic restart so a crash does not stall the wider pipeline
- Apply resource limits and seccomp filters to contain the impact of parser aborts on shared hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
