PatchTheCVECVE-2025-0870: A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641
CVE-2025-0870 is a medium-severity flaw (CVSS 5.6) affecting bento4. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-0870?
bento4: upgrade to newer than 1.6.0-641. Exact commands for each OS are on this page.
Is CVE-2025-0870 being exploited?
CVE-2025-0870 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-0870 affect?
CVE-2025-0870 affects bento4. Severity is medium (CVSS 5.6). A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflo
How urgent is CVE-2025-0870?
Priority 41/100. Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-57598 MEDIUM 6.5 DOWNGRADE A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_T
- CVE-2025-8537 LOW 3.7 UPGRADE A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641
- CVE-2025-0753 MEDIUM 6.3 UPGRADE A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0
- CVE-2025-0751 MEDIUM 6.3 UPGRADE A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0
- CVE-2024-31005 HIGH 8.1 DOWNGRADE An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cp