Bento4 1.6.0.0 contains an integer underflow in the AVCC and HVCc configuration atom parsers. If an MP4 file includes an atom whose declared size is smaller than the standard header size (AP4_ATOM_HEADER_SIZE), the parser creates an oversized buffer and passes invalid or null pointers to a copy routine. This causes the application to terminate, resulting in a denial of service. The weakness is improper integer handling leading to an oversized buffer operation.

Bento4 version 1.6.0.0 is affected. No other affected versions or products are listed.

Attack exploitation requires the delivery of a specially crafted MP4 file that contains an atom with a declared size smaller than the standard header size. The likely attack vector is that an application parsing user‑supplied media receives this file, triggering the underflow during parsing. Based on the description, it is inferred that the delivery could occur locally or over a network, depending on how media files are provided to the application. The CVSS score of 6.2 and EPSS score of < 1% indicate moderate severity and low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been observed in widespread targeted attacks. Nevertheless, any successful exploit results in application termination, providing a clear denial‑of‑service impact.