PT-2025-31892 · Axiomatic · Bento4

Xudong Cao + 1 · Published 2025-08-05 · Updated 2025-09-12 · CVE-2025-8537

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Axiomatic Bento4 versions up to 1.6.0-641

Description A problematic issue exists in the mp4decrypt component, specifically within the AP4 DataBuffer::SetDataSize function of the Mp4Decrypt.cpp file. This issue leads to resource allocation. The attack can be launched remotely, but is considered difficult to exploit. The exploit has been publicly disclosed.

Recommendations Update to a version of Axiomatic Bento4 newer than 1.6.0-641.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Assertion Failure

Weakness Enumeration

CWE-400

CWE-770

CWE-617

Related Identifiers

CVE-2025-8537

Affected Products

Bento4

References · 11

• 🔥 https://github.com/axiomatic-systems/Bento4/issues/1037 · Exploit
• 🔥 https://drive.google.com/file/d/1AkRpx3wcMy3Ic9tQeQyRJybBipK72aQO/view?usp=drive_link · Exploit
• 🔥 https://vuldb.com/?submit.619602 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8537 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8537 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1952566538390634772 · Twitter Post
• https://t.me/cveNotify/135273 · Telegram Post
• https://vuldb.com/?ctiid.318666 · Note
• https://vuldb.com/?id.318666 · Note
• https://twitter.com/CVEnew/status/1952539701812040021 · Twitter Post
• https://t.me/CVEtracker/29161 · Telegram Post