MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. This flaw can result in memory leakage of adjacent heap data and can cause applications such as mp4chaps to crash. The vulnerability is a classic CWE-125 out-of-bounds read.

The affected product is mp4v2 developed by enzo1982, specifically versions up to and including 2.1.3. Users running any of these releases should review their deployments for the presence of the vulnerable library.

The CVSS score of 6.9 denotes a moderate severity. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting moderate but not high exploitation likelihood. Attackers must supply a malicious MP4 file that contains a chapter sample shorter than its declared title length; they can then trigger the read, potentially leaking adjacent heap memory or causing a crash. This is a local or application-level attack vector; there is no documented remote exploitation such as network delivery. Based on the description, the attacker can influence the file input to the vulnerable function.