CVE-2025-0870 - CVE House

Back to Database

Status published Medium CVE-2025-0870

Axiomatic Bento4 Ap4DataBuffer.h GetData heap-based overflow

6.3 CVSS

Vulnerability Description

A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-0870

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Axiomatic

View All →

Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resources

Axiomatic Bento4 mp42aac ReadPartial heap-based overflow

Axiomatic Bento4 mp42aac ReadBits heap-based overflow

Axiomatic Bento4 mp42aac heap-based overflow

Axiomatic Bento4 mp4info Ap4StdCFileByteStream.cpp ReadPartial heap-based overflow

Affected Vendor

Axiomatic

View all reports →

Affected Software

Bento4

Vulnerable Versions:

1.6.0-641

Timeline

Official Publish: January 30th, 2025

Last Modified: January 30th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-122 CWE-119

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control