CVE-2022-40737

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located in System/StdC/Ap4StdCFileByteStream.cpp, called from AP4_ByteStream::Write and AP4_HdlrAtom::WriteFields.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/axiomatic-systems/Bento4/issues/756Exploit, Issue Tracking, Third Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/756Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Sep 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-407386.5An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_DescriptorListWriter::Action in Core/Ap4Descri CVE-2022-407395.4Ragic report generation page has insufficient filtering for special characters. A remote attacker with general user privilege can inject Jav CVE-2022-407407.2Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this CVE-2022-407419.8Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this v CVE-2022-407426.5Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execut CVE-2022-407436.1Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scr CVE-2022-407445.4IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2022-407455.5IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-CVE-2022-407466.7IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on CVE-2022-407479.1"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote at CVE-2022-407485.4IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2022-407505.4IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java