Axiomatic Bento4 mp4edit Create memory leak

Description

A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212009 was assigned to this vulnerability.

Scores

EPSS (exploitation in 30 days)

0.92% · top 40% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-404 Denial of Service -> CWE-401 Memory Leak (opens in a new tab)All about CWE-404 and its CVEs
• CWE-401 (opens in a new tab)All about CWE-401 and its CVEs

Affected products

• Axiomatic · Bento4

  • affected n/a

References (3)

• https://github.com/axiomatic-systems/Bento4/issues/776 (opens in a new tab)x_transferred
• https://github.com/axiomatic-systems/Bento4/files/9675042/Bug_2_POC.zip (opens in a new tab)x_transferred
• https://vuldb.com/?id.212009 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-3669](https://trackcve.app/badge/CVE-2022-3669.svg)](https://trackcve.app/cve/CVE-2022-3669)

Record last updated 14 Apr 2025, 15:56 UTC.