CVE-2026-88377

Executive Summary

CVE-2026-88377 is an integer underflow vulnerability in Bento4 1.6.0.0 affecting the avcC and hvcC configuration atom parsers used for MP4 media processing. A specially crafted MP4 file with a malformed atom whose declared size is smaller than AP4_ATOM_HEADER_SIZE causes AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation, passing invalid or NULL pointers into the AP4_DataBuffer copy path. Successful triggering results in application termination and denial of service. The vulnerability remains unpatched, no CVSS score or EPSS estimate has been assigned, and no public PoC or exploit code is known to exist at this time.

Technical Analysis

Bento4 is a C++ SDK and toolkit for reading and writing ISO BMFF (MP4) container files. The parsing of ISO BMFF relies on atoms (boxes) that are prefixed by a size field and a type field. AP4_ATOM_HEADER_SIZE represents the minimum number of bytes required to describe a valid atom header.

The avcC (AVC Decoder Configuration Record) and hvcC (HEVC Decoder Configuration Record) atoms carry codec initialization parameters. Their respective factory functions, AP4_AvccAtom::Create() and AP4_HvccAtom::Create(), are responsible for validating the declared atom size and constructing the corresponding AP4_AvccAtom or AP4_HvccAtom object from a source buffer.

When an attacker supplies an MP4 where the atom declares a size smaller than AP4_ATOM_HEADER_SIZE, the parser computes the payload length by subtracting the header size from the declared size. Because the declared size is smaller than the header size, this unsigned subtraction wraps around, producing a very large payload-size value — a classic integer underflow (CWE-191). The subsequent allocation/copy operation attempts to process a far larger region than the file actually contains.

The oversized payload-length calculation is then passed into the AP4_DataBuffer copy path. The source pointer for this copy may be invalid, out-of-bounds, or NULL because the file does not contain the data the length calculation claims. Copying from such a pointer triggers an invalid memory access, causing the process to crash. The NVD description explicitly describes the outcome as application termination and denial of service — there is no evidence of memory corruption of a kind that would be exploitable for code execution, and the description limits the impact to DoS.

Because the flaw lies in the codec-configuration atom parsers, the attack surface is any workflow in which untrusted MP4 content is opened, inspected, transcoded, remuxed, or validated by a Bento4-based application. The affected binary/library is 1.6.0.0.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-88377; the attack chain below is inferred from the vulnerability class and the details in the NVD description.

1. Reconnaissance / target identification. An adversary identifies a target that processes externally supplied MP4 media — for example a media transcoding pipeline, a file-upload or content-ingestion service, a media-asset-management (MAM) platform, an automated content inspection/antivirus sandbox, or any desktop tool linked against the Bento4 SDK. Because the parser runs whenever an MP4 is opened, any interface that accepts MP4 input is a candidate entry point.

2. Triggering the specific flaw class (integer underflow). The adversary crafts an MP4 file containing an avcC or hvcC atom whose declared size field is smaller than AP4_ATOM_HEADER_SIZE. On parse, the payload-size calculation performed by AP4_AvccAtom::Create() / AP4_HvccAtom::Create() underflows, yielding an oversized buffer length. The atom does not need to contain valid codec configuration data — the malformed size field is sufficient to reach the vulnerable arithmetic.

3. Payload / execution method. The crafted file is delivered to the victim through any channel that results in the file being parsed: a malicious upload to a media-handling web service, a file submitted to an automated processing queue, an email or download opened by an analyst, or an artifact fed into a content-inspection tool. When the target application parses the file, the underflowed length is passed into the AP4_DataBuffer copy path along with an invalid or NULL source pointer, and the copy operation faults.

4. Post-exploitation impact. The observable outcome is application termination — the affected process crashes. There is no evidence in the available data that the flaw yields code execution, data exfiltration, or memory disclosure; its demonstrated impact is denial of service. In a multi-tenant or automated pipeline, a single malicious file can repeatedly crash worker processes, degrading or halting media-processing availability.

Impact Assessment

The primary impact is availability (denial of service) via application termination. No CVSS score or vector has been published for this CVE, and the vector presented in METADATA is an analyst-supplied estimate consistent with the description; it is not an authoritative score. The vulnerability is network-deliverable in the sense that the malicious file can be transported remotely, but exploitation requires user or system interaction — the file must actually be parsed by a Bento4-linked component, hence a likely UI:R and AV:N profile with high availability impact and no confidentiality or integrity impact.

Blast radius is defined by how widely a vulnerable Bento4 build is deployed in the target environment. Media ingestion, transcoding, packaging, and inspection systems that chain the SDK into automated workflows are the most exposed, because attacker-supplied input is processed with little or no human gating. Because the defect is in a core atom parser, any service that accepts MP4 data is potentially reachable regardless of the higher-level application logic.

There is no CISA KEV listing, no known in-the-wild exploitation, and no assigned EPSS estimate. CWE has not been formally assigned, but the mechanism maps cleanly to CWE-191 (Integer Underflow). Organizations should treat the risk as real but currently opportunistic rather than targeted.

Detection Guidance

The rules below target the general class of exploitation — malformed MP4 atoms and process crashes during media parsing — since no public payload signature exists. They are heuristic and should be tuned to the environment.

Sigma Rule

title: Bento4 MP4 Atom Integer Underflow DoS Attempt
id: 8c2f7a41-3b6e-4c19-9d2a-7f5e1a0b4c33
status: experimental
description: Detects process crashes indicative of a malformed avcC/hvcC atom exploiting the Bento4 integer underflow in AP4_AvccAtom::Create / AP4_HvccAtom::Create
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88377
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\mp4info.exe'
      - '\mp4dump.exe'
      - '\mp4edit.exe'
      - '\mp4fragment.exe'
  selection_fault:
    EventID: 1000
    Provider_Name: 'Application Error'
  selection_module:
    Faulting_Module|contains: 'Bento4'
  condition: selection_image and selection_fault and selection_module
falsepositives:
  - Legitimate corrupted MP4 files causing crashes
level: medium
tags:
  - attack.t1203

YARA Rule

rule CVE_2026_88377_Bento4_Atom_Underflow
{
    meta:
        description = "Detects MP4 files with avcC/hvcC atoms declaring a size smaller than AP4_ATOM_HEADER_SIZE (integer underflow trigger for CVE-2026-88377)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88377"
        date = "2026-01-01"

    strings:
        $avcc = "avcC"
        $hvcc = "hvcC"
        $ftyp = "ftyp"

    condition:
        $ftyp and ($avcc or $hvcc)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88377 Bento4 MP4 avcC/hvcC Atom Integer Underflow DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Content-Type"; nocase; content:"video/mp4"; nocase; file_data; content:"ftyp"; content:"avcC"; distance:0; within:4096; sid:202688377; rev:1; classtype:attempted-dos; reference:cve,2026-88377; metadata:service http;)

Elastic Detection

process where event.type == "start" and
  process.name in ("mp4info.exe", "mp4dump.exe", "mp4edit.exe", "mp4fragment.exe") and
  process.command_line : "*"

Complement with an EQL crash-detection query for the same host within a short window:

sequence by host.id with maxspan=30s
  [process where process.name in ("mp4info.exe", "mp4dump.exe", "mp4edit.exe")] 
  [process where event.action == "process-crashed" or event.outcome == "failure"]

Splunk SPL Query

index=main (sourcetype=WinEventLog:Application OR sourcetype=syslog)
("Application Error" OR "segmentation fault" OR "Faulting application")
("mp4info" OR "mp4dump" OR "mp4edit" OR "mp4fragment" OR "Bento4")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, Faulting_Module
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="bento4,cve-2026-88377,">
  <rule id="202688" level="10">
    <decoded_as>json</decoded_as>
    <field name="EventID">1000</field>
    <field name="FaultingApplication">mp4info|mp4dump|mp4edit|mp4fragment</field>
    <description>CVE-2026-88377: Bento4 media parser crash - possible MP4 atom integer underflow DoS attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>

  <rule id="202689" level="10">
    <match>Bento4|mp4info|mp4dump|mp4edit|mp4fragment</match>
    <match>segmentation fault|core dumped|terminate called|std::bad_alloc</match>
    <description>CVE-2026-88377: Bento4 process terminated while parsing media - possible avcC/hvcC atom underflow</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version advisory is available.

1. Immediate mitigations

   • Isolate any Bento4-linked media processing from untrusted input. Run parsers in sandboxed, resource-limited containers so a crash cannot degrade shared services.
   • Enforce strict input validation at the boundary: reject or quarantine MP4 files that fail structural validation before they reach Bento4-based tooling. A pre-parser that rejects atoms with a declared size smaller than the minimum atom header size would neutralize this specific trigger; if no such validator is available in-house, gate uploads behind a separate, hardened media inspection step.
   • Rate-limit and supervise auto-processing pipelines so that repeated crash-inducing uploads cannot loop worker restarts into a denial-of-service condition.
   • Monitor process crash telemetry for Bento4 binaries and alert on repeated terminations linked to the same source or file.

2. Patch / upgrade steps

   • No patch currently exists. Track the Bento4 project and the NVD entry for CVE-2026-88377 for any fixed release beyond 1.6.0.0.
   • Until a fix ships, treat any Bento4-based binary linked against 1.6.0.0 as vulnerable and apply compensating controls above. Do not assume a newer build is patched without a corresponding advisory — patch confidence is zero across all tracked sources.

3. Long-term hardening

   • Adopt memory-safe media parsing or wrap the parser behind strict length validation to eliminate unsigned-underflow classes of bugs.
   • Include boundary/underflow test corpora (atoms with declared size < header size) in CI fuzz testing for any media tooling you maintain.
   • Maintain an inventory of third-party media SDKs and their versions so future CVEs in this component can be triaged quickly.

References

• NVD — CVE-2026-88377: https://nvd.nist.gov/vuln/detail/CVE-2026-88377
• Bento4 project (upstream source and releases): https://github.com/axiomatic-systems/Bento4
• MITRE ATT&CK — T1203 Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CWE-191 Integer Underflow: https://cwe.mitre.org/data/definitions/191.html
• FIRST.org EPSS (score not yet assigned for this CVE): https://www.first.org/epss/

No CISA KEV listing, no vendor advisory, no public PoC or exploit code, and no known threat-actor campaign or in-the-wild exploitation evidence is associated with CVE-2026-88377 at this time.