CVE-2025-8537— Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resources
Quick assessment
Affected
Axiomatic Bento4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Bento4是Axiomatic Systems开源的一款用于读写MP4文件的开源的C++库。 Bento4 6.0-641及之前版本存在安全漏洞，该漏洞源于文件Mp4Decrypt.cpp中函数AP4_DataBuffer::SetDataSize存在资源分配问题。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-8537
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resources
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allocation of resources. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
Bento4 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bento4是Axiomatic Systems开源的一款用于读写MP4文件的开源的C++库。 Bento4 6.0-641及之前版本存在安全漏洞，该漏洞源于文件Mp4Decrypt.cpp中函数AP4_DataBuffer::SetDataSize存在资源分配问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-8537
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-8537
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Bento4
-
CVE-2026-5236
Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based -
CVE-2026-5235
Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-bas -
CVE-2025-0870
Axiomatic Bento4 Ap4DataBuffer.h GetData heap-based overflow -
CVE-2025-0753
Axiomatic Bento4 mp42aac ReadPartial heap-based overflow -
CVE-2025-0751
Axiomatic Bento4 mp42aac ReadBits heap-based overflow
Same vendor: Axiomatic
-
CVE-2026-5236
Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based -
CVE-2026-5235
Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-bas -
CVE-2025-0870
Axiomatic Bento4 Ap4DataBuffer.h GetData heap-based overflow -
CVE-2025-0753
Axiomatic Bento4 mp42aac ReadPartial heap-based overflow -
CVE-2025-0751
Axiomatic Bento4 mp42aac ReadBits heap-based overflow
Same weakness: CWE-770
-
CVE-2026-90668
UnrealIRCd 6.2.6 HTTP头部限制缺失致拒绝服务 -
CVE-2026-48496
opentelemetry-ebpf-profiler: Unprivileged process can trigge -
CVE-2026-88012
Traefik: respondingTimeouts.readTimeout is not applied to HT -
CVE-2026-45763
Suricata lua: sandbox allocation limit not enforced for new -
CVE-2026-88878
Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
V. Comments for CVE-2025-8537
No comments yet