A buffer overflow occurs during the parsing of the MP4 'stsd' atom in Bento4’s AP4_StsdAtom::AP4_StsdAtom constructor. A maliciously crafted MP4 file can overflow the stack, causing the application to crash. The primary consequence is a denial of service, disrupting services that rely on Bento4 for video processing.

The flaw exists in all installations of Bento4 prior to version 1.8.9, a widely used MP4 processing library. Systems that embed Bento4 to handle user‑supplied MP4 files are at risk, including media players, transcoding pipelines, and any application that relies on Bento4 for validation or manipulation of MP4 content.

No public exploit has been reported and the EPSS score is unavailable, indicating limited known exploitation activity. However, because the vulnerability is triggered by a specially crafted MP4 file, an attacker who can supply such a file to a vulnerable Bento4 instance—such as through a web upload, email attachment, or network stream—can execute the denial of service. The lack of KEV listing suggests the vulnerability has not yet been widely abused, but the risk remains for any environment that processes untrusted MP4 data.