CVE-2022-3974

What it actually does

Heap-based buffer overflow in AP4_StdcFileByteStream::ReadPartial within Ap4StdCFileByteStream.cpp of the mp4info component, triggered by malformed input during remote file stream processing.

Why it matters to the business

Attackers can remotely crash the application or execute arbitrary code on systems processing untrusted MP4 files, risking data exposure, system compromise, and operational disruption across media workflows that depend on this library.

How an attack unfolds

An attacker crafts a malicious MP4 file that triggers the buffer overflow in the ReadPartial function when parsed by mp4info; because a public exploit exists, the file can be delivered remotely via download or upload and processed by any vulnerable Bento4 installation to achieve code execution.

How to fix it

Upgrade to the latest available version of Bento4 once a fix is released; in the interim, avoid processing untrusted MP4 files with mp4info and consider sandboxing or replacing the component with an alternative library.

How to confirm the fix worked

Rebuild and test with the latest Bento4 source; confirm the vulnerable ReadPartial implementation is no longer present by inspecting Ap4StdCFileByteStream.cpp and exercising mp4info against known malformed test cases.

Typical attack path

1. Craft a specially malformed MP4 file that overflows the heap buffer in AP4_StdcFileByteStream::ReadPartial
2. Deliver the file to the target system through web download, email attachment, or file upload
3. Victim or automated process invokes mp4info on the file
4. Overflow occurs during ReadPartial, enabling control of execution flow
5. Attacker payload executes, establishing remote access or crashing the process

How to detect it

Search application and system logs for unexpected crashes or abnormal memory usage when mp4info processes MP4 files; examine file-upload and download logs for MP4 files received after the public exploit disclosure date.

What your security team should do

• Immediately restrict use of mp4info on untrusted inputs and monitor for public exploit usage
• Track upstream Bento4 commits for a buffer-overflow fix and schedule rapid deployment
• Add MP4 file validation or sandboxing around any Bento4-dependent pipelines
• Review and inventory all internal and third-party uses of the affected library