CVE-2024-58397
MEDIUM
CVSS 6.1
Published: 2026-10-15
Modified: 2026-10-16
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.
Quick Facts
| CVE ID | CVE-2024-58397 |
| CVSS Score | 6.1 |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
| Published | 2026-10-15 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/enzo1982/mp4v2
- https://github.com/enzo1982/mp4v2/blob/f4c2f1b87446100728472…
- https://github.com/enzo1982/mp4v2/issues/53
- https://hackmd.io/@haind-pwn/mp4v2-getchapters-oob-read
- https://www.vulncheck.com/advisories/mp4v2-through-2.1.3-hea…
- https://hackmd.io/@haind-pwn/cve-2024-58397-mp4v2-getchapter…