A heap-based buffer overflow occurs in the AP4_BitReader::ReadCache function within the Ap4Dac4Atom.cpp component of Bento4. The flaw allows crafted MP4 input to overwrite heap memory, potentially corrupting program state and causing crashes or other unpredictable behavior. The CVE documentation does not assert that the overflow necessarily leads to arbitrary code execution, only that it can be exploited when the application processes an attacker‑controlled MP4 file.

The vulnerability affects all releases of Axiomatic Bento4 up to version 1.6.0‑641. This includes any installations that use the Bento4 MP4 processing library distributed by Axiomatic. No other vendors or product versions are listed.

The CVSS score of 4.8 indicates a moderate severity. Exploitation requires local access to the system running the vulnerable Bento4 binary; remote exploitation is not described. The vulnerability has been publicly disclosed, and an exploit may be utilized locally, but it is not currently listed in the CISA KEV catalog and the EPSS score is unavailable. The risk is primarily a local privilege escalation or stability issue for systems that run Bento4 under potentially untrusted contexts.