CVE-2024-58397

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/enzo1982/mp4v2
https://github.com/enzo1982/mp4v2/blob/f4c2f1b87446100728472d80fd1161d2f8e830b2/src/mp4file.cpp#L2618-L2627
https://github.com/enzo1982/mp4v2/issues/53
https://hackmd.io/@haind-pwn/mp4v2-getchapters-oob-read
https://www.vulncheck.com/advisories/mp4v2-through-2.1.3-heap-out-of-bounds-read-via-mp4file-getchapters
https://hackmd.io/@haind-pwn/cve-2024-58397-mp4v2-getchapters-oob-read

Configurations

No configuration.

History

27 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) MP4v2 hasta la versión 2.1.3 incluida contiene una lectura fuera de límites basada en el heap en MP4File::GetChapters() que permite a los atacantes leer más allá de las asignaciones de heap mediante muestras de capítulo de QuickTime manipuladas. Los atacantes pueden proporcionar un archivo MP4 cuya muestra de capítulo sea más corta que la longitud de su título declarado, provocando el bloqueo de aplicaciones como mp4chaps o filtrando memoria adyacente del heap en los títulos de los capítulos.

16 Oct 2026, 20:17

Type	Values Removed	Values Added
References		() https://hackmd.io/@haind-pwn/cve-2024-58397-mp4v2-getchapters-oob-read -

15 Oct 2026, 22:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 22:18

Updated : 2026-10-27 19:10

NVD link : CVE-2024-58397

Mitre link : CVE-2024-58397

CVE.ORG link : CVE-2024-58397

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2024-58397", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58397", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:45:16.510302Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/enzo1982/mp4v2", "vendor": "enzo1982", "product": "mp4v2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.3"}], "packageURL": "pkg:github/enzo1982/mp4v2", "defaultStatus": "unaffected"}]}], "published": "2026-10-15T22:18:06.893", "references": [{"url": "https://github.com/enzo1982/mp4v2", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/enzo1982/mp4v2/blob/f4c2f1b87446100728472d80fd1161d2f8e830b2/src/mp4file.cpp#L2618-L2627", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/enzo1982/mp4v2/issues/53", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@haind-pwn/mp4v2-getchapters-oob-read", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/mp4v2-through-2.1.3-heap-out-of-bounds-read-via-mp4file-getchapters", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@haind-pwn/cve-2024-58397-mp4v2-getchapters-oob-read", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles."}, {"lang": "es", "value": "MP4v2 hasta la versi\u00f3n 2.1.3 incluida contiene una lectura fuera de l\u00edmites basada en el heap en MP4File::GetChapters() que permite a los atacantes leer m\u00e1s all\u00e1 de las asignaciones de heap mediante muestras de cap\u00edtulo de QuickTime manipuladas. Los atacantes pueden proporcionar un archivo MP4 cuya muestra de cap\u00edtulo sea m\u00e1s corta que la longitud de su t\u00edtulo declarado, provocando el bloqueo de aplicaciones como mp4chaps o filtrando memoria adyacente del heap en los t\u00edtulos de los cap\u00edtulos."}], "lastModified": "2026-10-27T19:10:00.123", "sourceIdentifier": "disclosure@vulncheck.com"}