CVE-2024-57510
Published: 29 January 2025
Summary
CVE-2024-57510 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57510 is a buffer overflow vulnerability (CWE-120) in the mp42avc component of Bento4 at commit v.3bdc891602d19789b8e8626e4a3e613a937b4d35. It affects the AP4_MemoryByteStream::WritePartial function, enabling a local attacker to execute arbitrary code. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential within a local context.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution, potentially leading to high impacts on confidentiality, integrity, and availability on the affected system.
Mitigation details, including discussions of the issue and potential patches, are available in the referenced advisories: a GitHub Gist at https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24 and Bento4 GitHub issue #989 at https://github.com/axiomatic-systems/Bento4/issues/989. The vulnerability was published on 2025-01-29.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53604
Vulnerability details
Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow enables local arbitrary code execution from low-privileged context, directly mapping to exploitation for privilege escalation and client-side code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and patching of the specific buffer overflow flaw in Bento4's AP4_MemoryByteStream::WritePartial function.
Implements memory protection mechanisms like non-executable memory and ASLR to block arbitrary code execution from buffer overflow exploits.
Requires validation of inputs to media processing functions like WritePartial to prevent buffer overflows from malformed data.