CVE-2026-88377 Integer overflow in n/a
A crafted MP4 file triggers an integer underflow in Bento4, causing a denial of service via application termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88377?
CVE-2026-88377 is a medium-severity vulnerability in n/a, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination and denial of service.
Weakness: CWE-191
Which versions are affected by CVE-2026-88377?
How do I fix CVE-2026-88377?
No fix has been published for CVE-2026-88377 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-88377 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88377 exists.
Sources
Also known as GHSA-qrgr-2hhp-g9qm.