CVE-2026-36907 describes a stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of the Bento4 library versions prior to 1.8.9. An attacker can cause a Denial of Service by supplying a specially crafted MP4 file that triggers the overflow. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow). The CVSS v3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. No official fix or patch has been documented in the provided data.

Successful exploitation results in a Denial of Service (application crash or process termination) due to a stack overflow. There is no indication of confidentiality or integrity impact. The attack requires local access and user interaction, limiting remote exploitation potential. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted or malformed MP4 files with affected versions of Bento4. Monitor vendor communications for updates on patches or workarounds.