CVE-2024-24155

Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac cannot correctly delete when we got an no audio track found error. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mp4 file.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.64% chance of exploitation in the next 30 days, 48th percentile

Published

2024-02-28

Updated

2024-08-28

Proof-of-concept exploits (1)

• axiomatic-systems/Bento4/issues/919

References

• CVE Record
• NVD entry

Related

• CVE-2024-24150
• CVE-2024-24156
• CVE-2024-24149
• CVE-2024-24157
• CVE-2024-24148
• CVE-2024-24160