CVE-2026-36908: Bento4 Stack Overflow DoS Vulnerability

CVE-2026-36908 Overview

CVE-2026-36908 is a stack overflow vulnerability [CWE-121] in axiomatic-systems Bento4 versions prior to v1.8.9. The flaw resides in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component. A crafted MP4 file can trigger the overflow when processed by tools built on the Bento4 library, such as mp42aac. Successful exploitation causes a Denial of Service (DoS) through process crash. The vulnerability requires local access and user interaction to open a malicious media file. No public exploit code has been weaponized in the wild.

Critical Impact
A crafted MP4 file processed by Bento4 tooling crashes the parser through stack exhaustion, disrupting media processing pipelines and automated conversion workflows.

Affected Products

axiomatic-systems Bento4 versions before v1.8.9
Bento4 mp42aac utility
Applications and pipelines embedding the vulnerable Bento4 library for MP4 parsing

Discovery Timeline

2026-06-26 - CVE-2026-36908 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-36908

Vulnerability Analysis

Bento4 is a C++ toolkit for reading and writing ISO Base Media File Format containers, including MP4. The vulnerability sits in the templated container AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity, which manages the entry list for trun (Track Fragment Run) boxes. When Bento4 parses a fragmented MP4 file, the trun atom advertises a sample count that drives capacity expansion of the underlying array. A malformed or oversized sample count sent through EnsureCapacity produces a stack overflow condition during allocation and initialization of the entries. The result is an unrecoverable process crash affecting availability of the parsing utility.

Root Cause

The root cause is missing bounds validation on attacker-controlled fields inside the trun atom before they reach EnsureCapacity. Bento4 trusts the declared entry count and attempts to expand its internal array accordingly, exhausting the stack. This class of defect is tracked as CWE-121: Stack-based Buffer Overflow.

Attack Vector

An attacker crafts a malicious MP4 file with abnormal trun atom metadata and delivers it to a target user or automated workflow. When a victim opens the file with a Bento4-based tool such as mp42aac, parsing invokes EnsureCapacity and the process terminates. The impact is limited to availability; the CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects no confidentiality or integrity impact. A proof-of-concept sample is referenced in the GitHub PoC ZIP File.

The vulnerability manifests during array capacity growth inside the AP4_Array<AP4_TrunAtom::Entry> template. Because no verified exploit code is authorized for reproduction here, refer to the upstream Bento4 Issue #842 and MPC-BE Issue #1005 for the reporter's technical details and reproduction steps.

Detection Methods for CVE-2026-36908

Indicators of Compromise

Unexpected termination of mp42aac or other Bento4-based binaries during MP4 ingestion
Crash dumps referencing AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in the call stack
MP4 files with malformed or unusually large trun atom entry counts arriving from untrusted sources

Detection Strategies

Monitor process exit codes and signal terminations (SIGSEGV, SIGABRT) for Bento4 utilities in automated transcoding pipelines
Inventory endpoints and build systems for Bento4 versions earlier than v1.8.9 using software composition analysis
Inspect MP4 samples with mp4dump to flag trun atoms declaring implausible sample counts before downstream processing

Monitoring Recommendations

Alert on repeated crashes of media parsing services processing user-supplied files
Log file provenance for MP4 inputs entering conversion workflows to trace malicious samples
Correlate media-handler crashes with recent file uploads or email attachments containing MP4 content

How to Mitigate CVE-2026-36908

Immediate Actions Required

Upgrade Bento4 to v1.8.9 or later across all systems, containers, and CI pipelines
Restrict Bento4-based tooling to trusted MP4 sources until the patch is deployed
Rebuild any downstream binaries that statically link against the vulnerable Bento4 library

Patch Information

Upstream fixes are tracked in the axiomatic-systems Bento4 repository. Update to Bento4 v1.8.9 or later, which addresses the unchecked capacity growth path in AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity.

Workarounds

Run Bento4 utilities inside sandboxed or containerized environments with strict resource limits to contain crashes
Validate MP4 inputs with a hardened pre-parser that rejects malformed trun atoms before invoking Bento4
Disable or gate automated mp42aac conversion for untrusted user uploads until patching is complete

bash

# Configuration example: enforce stack and CPU limits for Bento4 workers
ulimit -s 8192
ulimit -t 30
mp42aac input.mp4 output.aac