CVE-2024-58397: Out-of-bounds Read in enzo1982 mp4v2

The vulnerability in mp4v2 (versions up to 2.1.3) involves an out-of-bounds read on the heap within the MP4File::GetChapters() function. When an attacker supplies an MP4 file where the chapter sample is shorter than the declared title length, the function reads beyond allocated heap memory. This can lead to application crashes or disclosure of adjacent heap memory contents into chapter titles. The flaw affects local attack vectors with low complexity and requires user interaction, but no privileges or user interface are needed. The CVSS 4.0 vector indicates limited confidentiality impact and high availability impact.

An attacker can cause a crash in applications using mp4v2 for chapter parsing or leak adjacent heap memory contents, potentially exposing sensitive information. The impact is limited to local attackers who can supply crafted MP4 files. There is no indication of remote exploitation or privilege escalation. The vulnerability affects availability and confidentiality to a medium degree.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, avoid processing untrusted MP4 files with affected versions of mp4v2 or use alternative tools that do not rely on vulnerable versions.