CVE-2024-58397: mp4v2 0 through 2.1.3

Affected technology

mp4v2 · 0 through 2.1.3
enzo1982

Description’s affected range: through 2.1.3

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as low; integrity impact as none; availability impact as high.