Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-43034: Bento4 Heap Buffer Overflow in Bit Reader

CVE-2022-43034 · published 4 years ago

Summary

A bug in Bento4's bit reader can cause a program to crash or behave unexpectedly when processing certain video files. This affects users who rely on Bento4 to convert or analyze video files. To protect your system, update to the latest version of Bento4.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:22.04:LTS	canonical	kodi-inputstream-adaptive	All versions
Ubuntu:24.04:LTS	canonical	kodi-inputstream-adaptive	All versions
Ubuntu:25.10	canonical	kodi-inputstream-adaptive	All versions
Ubuntu:26.04	canonical	kodi-inputstream-adaptive	All versions
–	axiosys	bento4	1.6.0-639 `cpe:2.3:a:axiosys:bento4:1.6.0-639:::::::*`

Original advisory text

An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) function in mp42ts.

References

https://ubuntu.com/security/CVE-2022-43034 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-43034 Third Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/764 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43034... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-43034 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published19 Oct 2022

Updated31 Oct 2026

First seen27 Apr 2026

Sources

UBUNTU-CVE-2022-43034 · OSV

CVE-2022-43034 · NVD

CVE-2022-43034 · OSV

Track software like this

Free during beta