CVE-2026-36908

Executive Summary

CVE-2026-36908 is a stack buffer overflow vulnerability in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of Axiomatic Systems Bento4, a widely used C++ MP4 parsing library. The flaw is triggered when processing a specially crafted MP4 file, causing a stack overflow that leads to a Denial of Service (DoS) condition. Applications and services that parse untrusted MP4 media files—including media servers, video processing pipelines, and security scanners that leverage Bento4—are affected on all platforms where the library is compiled. Exploitation requires only that a victim process a malicious MP4 file; no authentication or elevated privileges are needed, though user interaction (opening/parsing the file) is typically required.

The vulnerability has a CVSS score of N/A in the official record, but based on the attack vector and impact, we assess the severity as High given the low complexity of exploitation and the lack of any privilege requirements. A patch is claimed to exist in Bento4 v1.8.9; however, this has not been independently confirmed, and affected version ranges are not explicitly enumerated in the advisory.

Technical Analysis

The vulnerability resides in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity method, which is part of Bento4's atom parsing engine. The AP4_TrunAtom class handles the Track Run atom (TRUN) in MP4 files, which contains an array of AP4_TrunAtom::Entry structures describing sample properties such as duration, size, and flags.

The EnsureCapacity function is responsible for resizing the internal array buffer when new entries are appended. The flaw is a classic stack-based buffer overflow: when a malicious TRUN atom declares a sample_count field that is inconsistent with the actual data present in the file, EnsureCapacity attempts to allocate or copy data onto a fixed-size stack buffer. Specifically, an attacker can craft an MP4 file where the TRUN atom header advertises an extremely large sample_count (a 32-bit unsigned integer, allowing up to 4,294,967,295 entries). When the parser iterates to populate the array, the EnsureCapacity routine fails to validate the declared count against available data or stack limits, resulting in a stack overflow that corrupts the call stack and leads to a crash.

The attack surface is the MP4 parsing entry point. Any application calling AP4_File::Parse or AP4_Movie::Read on a user-controlled file is vulnerable. This includes:

• Media transcoding tools (e.g., mp4dump, mp4extract, mp4split) shipped with Bento4
• Web applications that accept MP4 uploads and process them server-side
• Mobile/desktop players embedding Bento4 for container parsing
• Security products that scan or index media files (e.g., sandbox solutions)

The vulnerability is triggered purely through file parsing—no network service needs to be exposed directly, though indirect exposure via file upload endpoints or media ingestion pipelines is common. The parse failure occurs early in the atom-parsing state machine, before any decompression or codec initialization, making the attack cheap and repeatable.

Exploitation Scenarios

The following is a concrete attack chain an adversary would follow to exploit CVE-2026-36908:

Step 1 — Target Identification and Reconnaissance: The attacker identifies a server-side application that ingests MP4 files. This could be a video hosting platform, a media transcription service, a cloud storage parser, or an antivirus sandbox. The attacker fingerprints the server's media stack by uploading a benign MP4 and observing HTTP response headers (e.g., X-Powered-By, Server) or error messages that leak library versions. Alternatively, the attacker gains knowledge of the target stack via public job postings or GitHub repositories of the organization.

Step 2 — Malicious File Crafting: The attacker uses a hex editor or a Python script with the mp4 parsing library to craft an MP4 file containing a TRUN atom with a deliberately malformed sample_count. The TRUN atom is constructed as follows:

Atom header: [size: 0x00000024] [type: 'trun']
Version/Flags: 0x00000000
Sample Count: 0xFFFFFFFF (declares 4,294,967,295 samples)
Data Offset: present
Entry bytes: minimal or absent (to force EnsureCapacity to extend stack buffer)

The attacker ensures the enclosing traf (Track Fragment) and moof (Movie Fragment) atoms are valid to pass initial integrity checks. The rest of the file can be filler bytes—only the TRUN atom needs to be malicious.

Step 3 — Delivery and Trigger: The attacker uploads the crafted MP4 to the target's ingestion endpoint (e.g., POST /api/upload with Content-Type: video/mp4). The server application invokes Bento4's AP4_File::Parse() on the uploaded file. The parser traverses the MP4 structure, reaches the TRUN atom, and calls AP4_TrunAtom::Read → AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity. The sample_count of 0xFFFFFFFF forces the EnsureCapacity to attempt a massive stack allocation, overflowing the fixed-size stack buffer and corrupting the return address.

Step 4 — Post-Exploitation Outcome: The stack overflow crashes the parsing process. On a single-threaded media ingestion service, this results in immediate termination of the worker process, knocking out availability for other queued jobs. If the service runs multiple workers, the attacker can re-upload the same file repeatedly to cause cascading worker failures, exhausting the server's process pool and causing a full application-level DoS. In a worst-case scenario (if the stack layout is favorable), the attacker might achieve arbitrary code execution, though the primary impact is DoS.

Impact Assessment

Business Impact: Denial of Service is the primary impact. For media-centric organizations (streaming platforms, CDNs, media archiving services), a single malicious file can crash a processing worker. Repeated exploitation leads to service degradation or complete outage of media ingestion, indexing, or transcoding pipelines. This translates to lost revenue, degraded user experience, and potential SLA violations.

Affected Systems: All software embedding Bento4 < 1.8.9. This includes:

• Custom media processing microservices
• Open-source tools like MP4Box variants (if linked against Bento4)
• Commercial video analytics platforms
• Forensic tools used in incident response that parse media

Blast Radius: The vulnerability is client-side in the sense that the parser must consume the file, but the attack vector is entirely remote (file upload). The CVSS vector AV:L is conservative; in many deployment scenarios the effective attack vector is network-adjacent (the attacker submits a file over HTTP). The integrity and confidentiality impact are nil (C:N/I:N), but availability impact is High (A:H). The attack requires no privileges and no user interaction beyond normal file processing, giving it a low exploitation complexity.

EPSS Context: The EPSS score is 0.00142 (4.0th percentile), indicating low current exploitation prevalence. However, this score is dynamic and can rise if PoC code is published.

Detection Guidance

Sigma Rule

title: Bento4 MP4 TRUN Atom Stack Overflow (CVE-2026-36908)
id: 6f3c1a2e-8b4a-4c5e-9f01-2a6b7c8d9e0f
status: experimental
description: Detects craft MP4 files with a malformed TRUN atom attempting to exploit CVE-2026-36908 in Bento4.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36908
author: Valtersit Threat Intel
date: 2026/06/01
logsource:
    category: process_creation
    product: linux
detection:
    selection_mp4_tools:
        Image|endswith:
            - '/mp4dump'
            - '/mp4extract'
            - '/mp4split'
            - '/mp4info'
    selection_args:
        CommandLine|contains:
            - '.mp4'
            - '.m4a'
    condition: selection_mp4_tools and selection_args
    timeframe: 5s
level: high
falsepositives:
    - Legitimate media processing of large or fragmented MP4 files
tags:
    - attack.t1499
    - cve.2026.36908

YARA Rule

rule CVE_2026_36908_Bento4_TrunOverflow
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects MP4 files with a TRUN atom declaring an excessive sample_count, targeting CVE-2026-36908"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-36908"
        severity = "high"
        cve = "CVE-2026-36908"
    strings:
        $trun = "trun" ascii
        $moof = "moof" ascii
        $traf = "traf" ascii
    condition:
        uint32be(0) >= 0x10 and filesize > 64 and
        $trun and $moof and $traf
        and for any i in (0..filesize-16) :
            ( uint32be(i) == 0x72756E00 or uint32be(i) == 0x00000000 ) and
            uint32be(i+4) >= 0x00001000
        and for any j in (0..filesize-16) :
            uint32be(j+4) = 0xFFFFFFFF
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-36908 Bento4 TRUN Atom MP4 Malformed Sample Count Denial of Service"; flow:to_server,established; content:"Content-Type|3a| video/mp4"; http_header; content:"|00 00 00 24 74 72 75 6e|"; http.request_body; content:"|ff ff ff ff|"; distance:12; within:16; http.request_body; classtype:denial-of-service; reference:cve,2026-36908; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-36908; sid:202636908; rev:1;)

Elastic Detection

// Detect process crashes associated with Bento4 MP4 parsing tools
process where event.type == "end" and process.exit_code != 0 and
(
  process.name in ("mp4dump", "mp4extract", "mp4split", "mp4info") or
  process.pe.original_file_name in ("mp4dump.exe", "mp4extract.exe", "mp4split.exe", "mp4info.exe")
)
and user.id != "0"
| stats count by process.name, process.command_line, agent.id
| filter count > 3 and count < 20  // repeated crashes indicative of malicious file processing

Splunk SPL Query

index=* sourcetype=WinEventLog:Security OR sourcetype=linux_audit
| search (process_name="mp4dump" OR process_name="mp4extract" OR process_name="mp4split" OR process_name="mp4info")
| rename process_name AS parser_process
| transaction host, parser_process maxspan=10m
| stats count as crash_count, dc(host) as host_count by parser_process, src_ip
| where crash_count > 5
| table _time, host, parser_process, src_ip, crash_count
| sort - crash_count

Wazuh OSSEC Rule

<group name="bento4, cve-2026-36908, dos,">
    <rule id="100368" level="10">
        <if_sid>5715</if_sid>
        <field name="process.name">^mp4(dump|extract|split|info)$</field>
        <field name="syscall">execve</field>
        <description>Bento4 parser invoked on potentially malicious MP4 file - CVE-2026-36908</description>
        <group>attack.t1499,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>

    <rule id="100369" level="12">
        <if_sid>100368</if_sid>
        <match>Segmentation fault|SIGSEGV|stack smashing|core dump</match>
        <description>Stack overflow detected in Bento4 parser - possible CVE-2026-36908 exploitation</description>
        <group>attack.t1499,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — a single source (OSV) claims a fix in Bento4 v1.8.9, but this has not been independently confirmed, and no vendor advisory or changelog has been verified.

1. Immediate Mitigations:

• Input Validation: Before passing any MP4 file to Bento4, implement a lightweight pre-parser that validates the TRUN atom's sample_count against the actual file size. Reject files where the declared sample count exceeds file_size / min_entry_size (32 bytes).
• Sandboxing: Run Bento4-based parsers in an isolated container or microVM with limited memory and CPU quotas. A crash will not affect the host process.
• Rate Limiting: Apply per-IP or per-user upload rate limits on endpoints accepting MP4 files to reduce the feasibility of repeated exploit attempts.
• Monitoring: Activate the detection rules above to alert on repeated Bento4 parser crashes.

2. Patch/Upgrade Steps:

• Check for an updated Bento4 release: git clone https://github.com/axiomatic-systems/Bento4 && cd Bento4 && git tag -l | grep "1.8.9". If v1.8.9 or later exists, rebuild your application against the patched version.
• If v1.8.9 is not available or unverified, apply a manual patch to AP4_TrunAtom.cpp: validate that sample_count in the TRUN atom does not exceed (atom_size - header_size) / sizeof(AP4_TrunAtom::Entry) before calling EnsureCapacity.
• Verify the patch by fuzzing Bento4 with malformed MP4 corpora (e.g., via afl-fuzz targeting mp4dump).

3. Long-Term Hardening:

• Dependency Management: Subscribe to OSV or GitHub Security Advisories for Bento4 to receive automated notification of future vulnerabilities.
• Build Hardening: Compile Bento4-linked applications with stack canaries (-fstack-protector-strong), non-executable stack (-z noexecstack), and FORTIFY_SOURCE enabled where applicable.
• Architecture: Replace direct Bento4 parsing in high-risk (internet-facing) services with a hardened wrapper or migrate to a memory-safe MP4 parser (e.g., Rust's mp4parse crate) for untrusted input.
• Continuous Fuzzing: Integrate Bento4 parsing into your CI pipeline with libFuzzer/AFL++ and a corpus of malformed MP4 files.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36908 — Official CVE record with description.
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-36908 — Single source claiming patch in v1.8.9.
3. Bento4 GitHub Repository: https://github.com/axiomatic-systems/Bento4 — Source code and release tags for version verification.
4. CWE-121 Reference: https://cwe.mitre.org/data/definitions/121.html — Stack-Based Buffer Overflow classification details.
5. MITRE ATT&CK T1499: https://attack.mitre.org/techniques/T1499/ — Endpoint Denial of Service tactic reference.

Threat Actor Campaigns / In-the-Wild Evidence: No known active exploitation campaigns have been reported as of this writing. The CVE is not listed on CISA KEV. The EPSS score of 0.00142 (4th percentile) indicates low current exploitation likelihood. However, Bento4 vulnerabilities have historically been targets for media-based malware and exploit kits; monitoring for a rise in EPSS or crash telemetry is advised.