CVE-2025-25944

HighPublic PoC

Published: 19 February 2025

Published

19 February 2025

Modified

13 May 2025

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0027 50.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25944 is a high-severity Code Injection (CWE-94) vulnerability in Axiosys Bento4. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 49.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the buffer overflow vulnerability in Bento4 by requiring identification, reporting, testing, and application of patches or upgrades to affected versions.

SI-16 Memory Protection good match

prevent

Implements memory protection features like non-executable data areas, stack canaries, and address space layout randomization to block arbitrary code execution from the buffer overflow in Ap4RtpAtom.

CM-10 Software Usage Restrictions partial match

prevent

Restricts usage and installation of vulnerable software such as Bento4 v1.6.0-641, preventing execution of mp4fragment on untrusted MP4 files.

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

Buffer overflow in local MP4 processing tool enables arbitrary code execution when a user is tricked into running the affected binary on a crafted file.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RtpAtom, during the execution of mp4fragment with a crafted MP4 input file.

Deeper analysisAI

CVE-2025-25944 is a buffer overflow vulnerability in Bento4 version 1.6.0-641, affecting the Ap4RtpAtom.cpp source file, specifically within the AP4_RtpAtom constructor. The issue arises when processing a crafted MP4 input file using the mp4fragment tool, leading to potential memory corruption. It is classified under CWE-94 (Code Injection) with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), indicating high impact but requiring local access and user interaction.

A local attacker with low privileges can exploit this vulnerability by supplying a maliciously crafted MP4 file and tricking a user into executing the mp4fragment tool on it. Successful exploitation allows arbitrary code execution in the context of the affected process, potentially granting the attacker high confidentiality, integrity, and availability impacts, such as data theft, modification, or denial of service.

The primary reference, a GitHub issue at https://github.com/axiomatic-systems/Bento4/issues/993, documents the vulnerability in the Bento4 repository, where further technical details and potential patches or workarounds may be discussed by the maintainers. Security practitioners should monitor this issue for official fixes and avoid processing untrusted MP4 files with affected Bento4 versions.