Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck
CVE-2024-58397MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
Medium 6.1
In plain English
A medium-severity out-of-bounds read in mp4v2 from enzo1982. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
References
- https://hackmd.io/@haind-pwn/mp4v2-getchapters-oob-read technical-description
- https://github.com/enzo1982/mp4v2/issues/53 issue-tracking
- https://github.com/enzo1982/mp4v2/blob/f4c2f1b87446100728472d80fd1161d2f8e830b2/src/mp4file.cpp#L2618-L2627 technical-description
- https://github.com/enzo1982/mp4v2 product
- VulnCheck Advisory: MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters third-party-advisory
- https://hackmd.io/@haind-pwn/cve-2024-58397-mp4v2-getchapters-oob-read exploit