The vulnerability exists in the AP4_BitReader::SkipBits function of the Ap4Dac4Atom.cpp file in Bento4’s DSI v1 Parser module. Manipulating the n_presentations argument can trigger a heap‑based buffer overflow, potentially corrupting memory, causing the application to crash, or enabling overwriting of executable data. This weakness aligns with CWE‑119 (Improper Handling of Buffer Size) and CWE‑122 (Heap-based Buffer Overflow). While the exploit requires local access to the Bento4 process, the resulting memory corruption could lead to denial of service or, in rare cases, local privilege escalation if an attacker can inject executable payloads.

All users running Axiomatic Bento4 versions up to and including 1.6.0‑641 are affected, as identified in the vendor’s issue report. No further versions are explicitly listed, so releases after 1.6.0‑641 should be safe until an official update is confirmed.

The CVSS base score is 4.8, indicating moderate severity, and no EPSS data is provided. The vulnerability has not been catalogued in CISA’s KEV database. Attackers must have local access to the Bento4 process to manipulate the SkipBits argument; however, publicly available exploit code demonstrates that the attack can be automated once local control is achieved. Because no official patch has been released, the risk remains until an update or mitigation is applied.