CVE-2025-0753

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStream::ReadPartial of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-122 CWE-787

Affected software

Vendor	Product	Versions
Axiomatic	Bento4	1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6

References

https://github.com/axiomatic-systems/Bento4/issues/991Exploit, Issue Tracking
https://github.com/user-attachments/files/18434657/seeds.zipExploit
https://vuldb.com/?ctiid.293518Permissions Required, VDB Entry
https://vuldb.com/?id.293518Permissions Required, VDB Entry
https://vuldb.com/?submit.483326Third Party Advisory

Timeline

Published: Jan 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-07544.3The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Env CVE-2025-07557.5The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that coul CVE-2025-07569.1Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before CVE-2025-07574.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is us CVE-2025-07586.1Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by CVE-2025-07593.3IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization CVE-2025-07602.7A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encrypt CVE-2025-07628.8Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2025-07634.3The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o CVE-2025-07646.5The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of th CVE-2025-07654.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that CVE-2025-07679.8WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writer