PT-2025-7586 · Bento4 · Bento4

K3Ppf0R · Published 2025-02-19 · Updated 2025-06-09 · CVE-2025-25946

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bento4 version 1.6.0-641

Description An issue in Bento4 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4 MarlinIpmpEncryptingProcessor::Initialize and AP4 Processor::Process, during the execution of mp4encrypt with a specially crafted MP4 input file.

Recommendations As a temporary workaround, consider disabling the AP4 MarlinIpmpEncryptingProcessor::Initialize and AP4 Processor::Process functions until a patch is available. Restrict access to the vulnerable modules Ap4Marlin.cpp and Ap4Processor.cpp to minimize the risk of exploitation. Avoid using the mp4encrypt function with specially crafted MP4 input files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-25946

Affected Products

Bento4

References · 6

• https://github.com/axiomatic-systems/Bento4/issues/994 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25946 · Security Note
• https://twitter.com/CVEnew/status/1892355487644983682 · Twitter Post
• https://t.me/cvenotify/125110 · Telegram Post
• https://t.me/cvedetector/18495 · Telegram Post