The vulnerability arises from an integer underflow in the AP4_AvccAtom::Create() and AP4_HvccAtom::Create() functions within Bento4. A crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header causes the payload-size calculation to wrap to a large unsigned value. This leads to an invalid buffer allocation and subsequent copy operations that crash the application, resulting in denial of service. The weakness is an Integer Underflow (CWE-191) that impacts availability through service interruption.

Bento4 version 1.6.0.0 is affected. All deployments utilizing this version of the Bento4 library are vulnerable. Versions prior to 1.6.0.0 or patches not yet released are unaffected. No other vendor or product names are specified beyond the Bento4 library itself.

The vulnerability has a CVSS score of 7.5, indicating a high severity. EPSS is not available, and it is not currently listed in the CISA KEV catalog, suggesting no widely observed exploitation. The attack likely requires an attacker who can supply a malicious MP4 file to the Bento4 parser, either by uploading a file or providing it in a local environment. Because the flaw manifests during file parsing, an attacker who can influence the file stream may trigger a denial of service, disrupting application availability.