CVE-2024-58397
MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.
| CWE | CWE-125 |
| Vendor | enzo1982 |
| Product | mp4v2 |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for enzo1982 mp4v2
Be the first to know when new medium vulnerabilities affecting enzo1982 mp4v2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
enzo1982 / mp4v2
0 ≤ 2.1.3
References
hackmd.io: https://hackmd.io/@haind-pwn/mp4v2-getchapters-oob-read github.com: https://github.com/enzo1982/mp4v2/issues/53 github.com: https://github.com/enzo1982/mp4v2/blob/f4c2f1b87446100728472d80fd1161d2f8e830b2/src/mp4file.cpp#L2618-L2627 github.com: https://github.com/enzo1982/mp4v2 vulncheck.com: https://www.vulncheck.com/advisories/mp4v2-through-2.1.3-heap-out-of-bounds-read-via-mp4file-getchapters
Credits
ctrlnocaps HaiND from the Post and Telecommunication Institute of Technology