CVE-2026-5236

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-5236

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5236.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-5236

Published

2026-03-31T23:00:19.377Z

Modified

2026-07-15T01:49:16.873157015Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow

Details

A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument npresentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5236.json",
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ]
}

References

Affected packages

Git / github.com/axiomatic-systems/bento4

Affected ranges

Type

GIT

Repo

https://github.com/axiomatic-systems/bento4

Events

Introduced

dc264854d1f76c370b65b18d9f303a95f7f21ab1

Last affected

dc264854d1f76c370b65b18d9f303a95f7f21ab1

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.6.0-641"
        },
        {
            "last_affected": "1.6.0-641"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.6.0-641

v1.*

v1.6.0-641

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5236.json"