CVE-2026-36907 Overview
CVE-2026-36907 is a stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before version 1.8.9. Attackers can trigger the flaw by supplying a crafted MP4 file, causing a Denial of Service (DoS) condition in applications that use the Bento4 library to parse MP4 media. Bento4 is a widely used C++ toolkit for reading, writing, and processing MP4 and DASH/HLS content. The weakness is classified as [CWE-121: Stack-based Buffer Overflow].
Critical Impact
Processing a malicious MP4 file causes the Bento4 parser to crash, disrupting media applications and downstream services that depend on the library.
Affected Products
- axiomatic-systems Bento4 versions prior to 1.8.9
- Applications embedding vulnerable Bento4 builds for MP4 parsing
- Media players and toolchains referencing the AP4_StsdAtom code path
Discovery Timeline
- 2026-06-26 - CVE-2026-36907 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-36907
Vulnerability Analysis
The vulnerability resides in the constructor AP4_StsdAtom::AP4_StsdAtom, which parses the Sample Description (stsd) atom within an MP4 container. When the constructor processes malformed or oversized fields, it writes beyond the bounds of a stack-allocated buffer. This causes stack memory corruption and terminates the host process.
The issue is a local, user-interaction-required flaw. A victim must open or process a crafted MP4 file with a vulnerable Bento4 build. Successful exploitation crashes the process, denying access to the media pipeline. The confidentiality and integrity impact are none; availability impact is high.
Root Cause
The root cause is missing bounds validation on atom fields read from the stsd structure during construction. Bento4 assumes attacker-controlled length or count fields are within safe ranges. When these values exceed the destination buffer size, the constructor overwrites adjacent stack memory. This maps directly to [CWE-121].
Attack Vector
An attacker crafts an MP4 file containing a malformed stsd atom and delivers it to a target user or service. The user opens the file with an application linked against a vulnerable Bento4 version. The parser reaches AP4_StsdAtom::AP4_StsdAtom, overflows the stack buffer, and crashes the process. No network access or elevated privileges are required.
The vulnerability mechanism is described in the upstream reports. See the Bento4 GitHub Issue #614 and the related MPC-BE Issue #1005 for reproduction context.
Detection Methods for CVE-2026-36907
Indicators of Compromise
- Unexpected termination or crash of media applications when opening MP4 files
- Stack corruption signatures in crash dumps referencing AP4_StsdAtom frames
- MP4 files with abnormally large or malformed stsd atom fields
Detection Strategies
- Scan software inventories for Bento4 builds earlier than 1.8.9 and any applications statically linking the library
- Use MP4 structural validators to flag files with malformed Sample Description atoms before ingestion
- Enable compiler mitigations such as stack canaries and monitor for canary-violation crash telemetry
Monitoring Recommendations
- Forward application crash logs and Windows Error Reporting or coredump data to centralized log storage
- Alert on repeated crashes of media parsing services tied to a specific input file hash
- Track file hashes of MP4 samples that trigger parser faults for correlation across endpoints
How to Mitigate CVE-2026-36907
Immediate Actions Required
- Upgrade Bento4 to version 1.8.9 or later in all products and internal tools
- Rebuild and redistribute any application that statically links the vulnerable Bento4 code
- Restrict processing of untrusted MP4 files until patched builds are deployed
Patch Information
Upgrade to axiomatic-systems Bento4 version 1.8.9 or newer, which addresses the stack overflow in AP4_StsdAtom::AP4_StsdAtom. Consult the Bento4 GitHub Issue #614 for upstream discussion and remediation references.
Workarounds
- Block or quarantine MP4 files from untrusted sources at the email and web proxy layer
- Run MP4 parsing in sandboxed or containerized processes to contain crashes
- Disable automatic media preview features that invoke Bento4-based parsers
# Configuration example: verify installed Bento4 version
mp4info --version
# Ensure version reported is 1.8.9 or later; otherwise upgrade the library.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
