CVE-2022-3663: Axiomatic Bento4 MP4fragment Ap4StsdAtom.cpp AP4_StsdAtom null pointer dereference

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-26 · updated 2026-06-17
Weakness: CWE-404

Description

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212003.

Affected products

Axiomatic Bento4: 1.6.0-639

References

https://github.com/axiomatic-systems/Bento4/files/9817303/mp4fragment_npd_Ap4StsdAtom.cpp75.zip
https://github.com/axiomatic-systems/Bento4/issues/800
https://vuldb.com/?id.212003
https://github.com/axiomatic-systems/Bento4/files/9817303/mp4fragment_npd_Ap4StsdAtom.cpp75.zip
https://github.com/axiomatic-systems/Bento4/issues/800
https://vuldb.com/?id.212003

Get alerted when CVE-2022-3663 or the next vulnerability affects your stack