CVE-2025-0870 Axiomatic Bento4 Ap4DataBuffer.h GetData heap-based overflow
A heap-based buffer overflow in the Bento4 library allows remote attackers to potentially execute arbitrary code or cause denial of service via crafted media files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0870?
CVE-2025-0870 is a medium-severity memory corruption vulnerability in Axiosys Bento4, published on 30 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
Which versions are affected by CVE-2025-0870?
It affects 1 product.
Products include Axiosys Bento4.
How do I fix CVE-2025-0870?
No fix has been published for CVE-2025-0870 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-0870 being exploited?
There is no known exploitation of CVE-2025-0870 in the wild and no public exploit code.
Other vulnerabilities in Axiosys Bento4
Sources
Also known as GHSA-xr94-h88h-jc73.