PatchTheCVECVE-2025-8537: A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641
CVE-2025-8537 is a low-severity flaw (CVSS 3.7) affecting bento4. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allocation of resources. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-8537?
bento4: upgrade to newer than 1.6.0-641. Exact commands for each OS are on this page.
Is CVE-2025-8537 being exploited?
CVE-2025-8537 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-8537 affect?
CVE-2025-8537 affects bento4. Severity is low (CVSS 3.7). A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allo
How urgent is CVE-2025-8537?
Priority 36/100. Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-57598 MEDIUM 6.5 DOWNGRADE A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_T
- CVE-2025-0870 MEDIUM 5.6 UPGRADE A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641
- CVE-2025-0753 MEDIUM 6.3 UPGRADE A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0
- CVE-2025-0751 MEDIUM 6.3 UPGRADE A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0
- CVE-2024-31005 HIGH 8.1 DOWNGRADE An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cp