CVE-2024-31002
Published: 02 April 2024
Summary
CVE-2024-31002 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Axiosys Bento4. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-31002 is a buffer overflow vulnerability in Bento4 version 1.6.0-641, specifically in the AP4_BitReader::ReadCache function within the Ap4Utils.cpp component. The flaw is classified under CWE-787 and carries a CVSS 3.1 score of 9.8, reflecting its critical severity due to network-accessible exploitation without authentication or user interaction.
A remote attacker can supply a crafted input that triggers the overflow, enabling arbitrary code execution on the affected system. Because the vulnerability requires no privileges or user action, it can be exploited over the network against any exposed Bento4 instance processing untrusted media files.
The EPSS score for this CVE has remained flat at 0.1044 with no material increase since disclosure. Public references consist of GitHub issue reports and a CVE tracking repository, but no vendor advisory or patch details are provided in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-28920
Vulnerability details
Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCache() at Ap4Utils.cpp component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.