CVE-2026-36907

Executive Summary

CVE-2026-36907 is a stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4. Successful exploitation allows an attacker to cause a denial-of-service (DoS) condition via a crafted MP4 file that triggers the vulnerable code path. The flaw affects all Bento4 versions prior to v1.8.9, with the patch being claimed by a single OSV source (patch confidence 2/4). While no public PoC or exploit code exists at the time of writing, the vulnerability is trivially triggerable with a malformed MP4 container and requires no authentication or special privileges beyond the ability to submit a crafted file to a processing pipeline.

Technical Analysis

Bento4 is a widely used C++ library and set of tools for parsing, demuxing, and manipulating MP4 (ISO BMFF) files. The vulnerable component is AP4_StsdAtom::AP4_StsdAtom, the constructor for the Sample Description (stsd) atom. This atom is a critical part of the MP4 container structure and describes the codec, sample entry layout, and associated metadata for media tracks.

The stack overflow occurs during the construction of the AP4_StsdAtom object. In the ISO BMFF specification, an stsd atom contains a sample_entry_count field, followed by one or more sample_entry boxes. Each sample entry is a box with a type (e.g., avc1, mp4a, hvc1) and a versioned structure. The vulnerable code path in AP4_StsdAtom reads the sample_entry_count and then iteratively processes each child box.

The overflow is triggered when the MP4 file contains either:

1. An stsd atom with an extremely large sample_entry_count value that causes the constructor to allocate insufficient stack space for an internal array or recursive parsing state, or
2. A crafted sample_entry box type that causes the constructor to write beyond the bounds of a fixed-size stack buffer during validation or decryption parameter extraction.

Because the flaw is in a constructor, it is triggered during the parsing phase—specifically when AP4_File::Parse encounters the stsd atom within a trak/mdia/minf/stbl hierarchy. Attackers control the exact values written to the stack through the MP4 byte stream, giving them the ability to corrupt adjacent stack frames. In the absence of stack canaries (common in release builds of C++ multimedia libraries), this can lead to immediate stack smashing detected by the OS (SIGSEGV/SIGABRT), or in more sophisticated attacks, potential control-flow hijacking, although the described impact is limited to DoS.

The attack surface is broad: any application that ingests untrusted MP4 files using Bento4—including media servers, transcoding pipelines, antivirus file scanners, and web applications that accept video uploads—is vulnerable. The library is also embedded in several popular open-source projects (e.g., MP4Box forks, various mobile applications).

Exploitation Scenarios

Attack Chain: Unauthenticated DoS via Malicious MP4 Upload

Step 1 — Reconnaissance/Identification (Attacker Perspective): The attacker identifies a target application that accepts MP4 file uploads and uses Bento4 for parsing (e.g., a video-sharing platform, a surveillance system with video ingestion, or a media-processing API). The attacker fingerprints the Bento4 version by sending a valid MP4 and observing error messages or timing differences, or by examining publicly-available documentation of the target framework. Alternatively, the attacker directly targets known tools like mp4dump, mp4info, or mp4extract if they have local access to a system using them.

Step 2 — Weaponization (Crafting the Payload): The attacker generates a base valid MP4 file with a single video track. Using a binary editor or a custom Python script (leveraging struct module to control byte-level layout), the attacker locates the stsd atom. They then modify the sample_entry_count field to a value of 0x7FFFFFFF (2^31-1) or a smaller value that triggers the overflow condition in the specific build of Bento4. Alternatively, they replace the sample_entry box type with a malformed custom four-character code (e.g., !!!!) that leads to an unexpected parsing path in AP4_StsdAtom::AP4_StsdAtom. The attacker ensures the stsz (sample size) and stco (chunk offset) atoms are removed to reduce the chance of the parser failing before reaching stsd.

Step 3 — Delivery and Trigger:

• Remote (web upload): The attacker submits the crafted MP4 to the target's upload endpoint via an HTTP POST request (multipart/form-data). The server-side handler passes the file buffer to the Bento4-based parser. Upon encountering the stsd atom, the AP4_StsdAtom constructor executes the vulnerable code, overflowing the stack.
• Local (file processing): The attacker drops the file into a watched directory or uses email/IM to deliver it to a victim system running a Bento4-based utility (e.g., a media transcoder) that auto-processes new files.

Step 4 — Post-Exploitation Impact: The stack overflow leads to immediate process termination (segmentation fault) or a stack-smashing abort. In a server environment, this translates to a crash of the worker process. If the vulnerable component runs inside a single-threaded, non-forking server, the crash takes down the entire service (availability loss). In multi-process architectures (e.g., uWSGI/FastCGI), repeated submissions can be used to rapidly exhaust worker pools, resulting in sustained DoS. No data is exfiltrated, and no code is accessed, limiting impact to availability. However, if the process runs with elevated privileges and stack canaries are absent, skilled attackers might chain this with a heap-spray or other memory-corruption primitives to achieve code execution, though no public evidence of this exists.

Impact Assessment

Business Impact: High availability impact. The vulnerability allows a low-skill actor to craft a small (few hundred bytes) MP4 file that crashes the parser. For organizations running public-facing media processing platforms, video hosting, transcoding services, or security tools that scan MP4 files (e.g., email gateways with content disarm), this translates to cost of service disruptions and potential missed SLAs on media ingestion.

Affected Systems: All Bento4 versions before v1.8.9. This includes:

• The suite of command-line utilities (mp4dump, mp4info, mp4extract, mp4tag).
• Applications embedding the Bento4 library (e.g., Bento4 for Android, certain media players, enterprise document sanitization tools).

CVSS Assessment: CVSS score is N/A (unassigned at the time of writing). Based on the attack vector (network upstream of a parsing service), attack complexity (low—requires a single crafted file), privileges (none), user interaction (none), and scope (unchanged), a realistic provisional score would be High (7.5–8.0) under the AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H profile. Confidentiality and integrity impact are null; availability is high.

Blast Radius: The exploit does not require authentication or advanced network access—only the ability to deliver a file to the parsing logic. This makes it a viable vector for unauthenticated remote DoS in internet-facing applications. No lateral movement is possible, but the ease of execution (scriptable, repeatable) amplifies the availability impact.

EPSS Score: 0.00125 (2.6th percentile)—indicating a low current probability of exploitation in the wild. This is consistent with the lack of public PoC/exploit code and a relatively niche library. However, EPSS can spike rapidly once weaponized exploit code is published.

Detection Guidance

Sigma Rule

title: Bento4 AP4_StsdAtom Stack Overflow via Crafted MP4
id: 0f8d3e1a-7b2c-4a6d-9e3f-5c1b8a2d4e6f
status: experimental
description: Detects crashes or abnormal process behavior associated with Bento4 parsing of malicious MP4 files triggering CVE-2026-36907.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36907
tags:
    - attack.t1499
    - cve.2026.36907
logsource:
    product: linux
    category: process_creation
detection:
    selection_cmdline:
        CommandLine|contains:
            - 'mp4dump'
            - 'mp4info'
            - 'mp4extract'
            - 'mp4tag'
    selection_crash:
        # adjust for SIGSEGV (11) / SIGABRT (6)
        ExitCode|in:
            - '139'  # 128 + 11 (SIGSEGV)
            - '134'  # 128 + 6 (SIGABRT)
    condition: selection_cmdline and selection_crash
    timeframe: 5m
level: high
falsepositives:
    - Legitimate malformed MP4 files from unreliable sources
    - Bento4 bugs unrelated to CVE-2026-36907
fields:
    - ParentImage
    - Image
    - CommandLine
    - User

YARA Rule

rule CVE_2026_36907_Bento4_StsdAtom_Overflow {
    meta:
        author = "Valters IT SOC"
        description = "Detects crafted MP4 files attempting to exploit stack overflow in AP4_StsdAtom (CVE-2026-36907)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-36907"
        date = "2026-10-01"
        severity = "high"
        cve = "CVE-2026-36907"
    strings:
        // stsd box header: size (4) + 'stsd' (4)
        $stsd = { 73 74 73 64 }  // 'stsd' ascii
        // MP4 fullbox flags/version bytes following stsd (count field location)
        // Typically: version(1) + flags(3) + entry_count(4)
        // High entry_count = 0xFFFFFFFF (max) or 0x7FFFFFFF
        $huge_count_f = { 73 74 73 64 ?? ?? ?? ?? FF FF FF FF }
        $huge_count_7 = { 73 74 73 64 ?? ?? ?? ?? 7F FF FF FF }
        // Look for oversized sample_entry_size after stsd
        // Also catches anomalous box sizes > 0xFF000000
        $oversized_box = { 73 74 73 64 (?? FF FF FF | FF ?? FF FF) }
    condition:
        uint32(0) == 0x66747970 and
        any of ($stsd*) and
        ($huge_count_f or $huge_count_7 or $oversized_box) and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-36907 Bento4 MP4 stsd stack overflow attempt"; flow:established,to_server; content:"Content-Type|3a| multipart/form-data"; http_header; pcre:"/\x73\x74\x73\x64.{0,8}(?:\xFF\xFF\xFF\xFF|\x7F\xFF\xFF\xFF)/"; sid:10000001; rev:1; metadata:cve,CVE-2026-36907; reference:url,https://www.valtersit.com/cve-2026-36907;)

Elastic Detection

// Detect abnormal Bento4 process exits after handling uploaded files
process where event.action == "end" and
process.name in ("mp4dump", "mp4info", "mp4extract", "mp4tag") and
process.exit_code in (134, 139) and
process.parent.name in ("httpd", "nginx", "node", "python", "php-fpm")

Splunk SPL Query

index=wineventlog OR index=linux_sysmon
| where (Image IN ("*mp4dump*", "*mp4info*", "*mp4extract*", "*mp4tag*"))
    OR (CommandLine LIKE "%mp4dump%" OR CommandLine LIKE "%mp4info%"
        OR CommandLine LIKE "%mp4extract%" OR CommandLine LIKE "%mp4tag%")
| search `bento4_crash_events`  // Look for EventID 4688 (process creation) with exit codes
| eval exit_code = if(match(Message, "ExitStatus=139"), 139,
                  if(match(Message, "ExitStatus=134"), 134, 0))
| search exit_code IN (134, 139)
| stats count by host, user, ParentImage, Image, _time
| sort - _time

Wazuh OSSEC Rule

<group name="bento4_cves,">
    <rule id="524767" level="12">
        <if_sid>571</if_sid>  <!-- auditd syscall rule for execve -->
        <field name="audit.data.syscall">execve</field>
        <regex>arg2="\S*(mp4dump|mp4info|mp4extract|mp4tag)\S*"</regex>
        <description>Bento4 utility executed - potential CVE-2026-36907 trigger vector</description>
        <group>cve-2026-36907,</group>
    </rule>
    <rule id="524768" level="12">
        <if_sid>3690701</if_sid>
        <field name="audit.data.exit">-11|-6</field>  <!-- SIGSEGV / SIGABRT from auditd -->
        <description>CVE-2026-36907 possible stack overflow detected - Bento4 crashed (SIGSEGV/SIGABRT) processing file</description>
        <group>cve-2026-36907,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source (OSV) claims patch; not independently confirmed). Treat the v1.8.9 fix as authoritative but verify in your environment.

1. Immediate Mitigations (no-code, high priority):

• Isolate Bento4 parsing in a sandboxed, resource-limited container or VM. Restrict CPU/memory and enforce cgroup limits to contain a potential crash.
• Add input validation at the application layer: before calling Bento4, parse the MP4 header (first 32 bytes) with a lightweight strict parser to reject files with absurd stsd entry counts (e.g., > 1000 per track) or malformed box size fields.
• Rate-limit file uploads per IP/user to prevent automated crash-loop attacks.
• For CLI tools used in cron jobs or batch processing, run them with ulimit -c 0 and enable core dumps analysis for faster forensics.

2. Patch/Upgrade Steps:

• Upgrade to Bento4 v1.8.9 or later from https://github.com/axiomatic-systems/Bento4 (git checkout v1.8.9 or pull latest master).
• If you are using a distribution package, check the vendor channel: Debian/Ubuntu (apt-cache policy libbento4-dev), Homebrew (brew upgrade bento4), or vcpkg (vcpkg upgrade bento4).
• Rebuild any applications statically linking Bento4.
• Verify the patch: run git diff v1.8.8..v1.8.9 -- source/Core/Ap4StsdAtom.cpp to confirm changes to AP4_StsdAtom constructor boundary checks. If the OSV patch is not independently confirmed, report back to the CVE CNA.

3. Long-Term Hardening:

• Enable stack canaries (-fstack-protector-all) and compile Bento4 with ASan (AddressSanitizer) in development builds to catch similar flaws early in the QA cycle.
• Adopt fuzzing for MP4 parsing: integrate Bento4 into your CI with libFuzzer or AFL++ and a corpus of malformed MP4 files.
• Monitor the CVE: subscribe to OSV alerts (osv.dev) for Bento4 package to get updated patch confirmations.
• Review deployment: if Bento4 is used in a public-facing service, ensure the parser runs in a separate, unprivileged user (e.g., nobody) with no write access to the webroot.

References

1. NVD Entry: CVE-2026-36907 — https://nvd.nist.gov/vuln/detail/CVE-2026-36907
2. Vendor Repository (axiomatic-systems/Bento4) — https://github.com/axiomatic-systems/Bento4 (Release v1.8.9)
3. OSV Database Entry — https://osv.dev/vulnerability/OSV-2026-XXXX (source of patch claim)
4. Bento4 Documentation/API Reference (AP4_StsdAtom) — https://www.bento4.com/developers/
5. CISA Known Exploited Vulnerabilities (KEV) Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-36907 NOT listed, as of this writing)

Threat Actor Activity / In-the-Wild Evidence: No active exploitation campaigns, exploit code, or Nuclei templates have been observed in public sources as of the report date. The EPSS percentile (2.6%) reflects a low likelihood of near-term exploitation. However, the attack vector is trivial (crafted MP4 file), so this assessment should be revisited when Bento4 v1.8.9 patch adoption data becomes available.