PT-2024-23623 · Bento4 · Bento4

Zhangteng0526 · Published 2024-04-02 · Updated 2025-05-27 · CVE-2024-30809

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bento4 version 1.6.0-641-2-g1529b83

Description An issue was discovered in Bento4, leading to a Denial of Service (DoS). The issue is a heap-use-after-free in Ap4Sample.h in the AP4 Sample::GetOffset() function, as demonstrated by mp42ts.

Recommendations For Bento4 version 1.6.0-641-2-g1529b83, consider disabling the AP4 Sample::GetOffset() function as a temporary workaround until a patch is available. Restrict access to the vulnerable module Ap4Sample.h to minimize the risk of exploitation. Avoid using the GetOffset() function in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-30809

Affected Products

Bento4

References · 9

• 🔥 https://github.com/axiomatic-systems/Bento4/issues/937 · Exploit
• 🔥 https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-30809 · Exploit
• https://osv.dev/vulnerability/CVE-2024-30809 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30809 · Security Note
• https://t.me/cvenotify/75541 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1775263181822455998 · Twitter Post
• https://t.me/cvenotify/75528 · Telegram Post
• https://t.me/cvenotify/123709 · Telegram Post
• https://twitter.com/CVEnew/status/1775216841473859830 · Twitter Post