CVE-2026-36908 describes a stack overflow in the EnsureCapacity function of the AP4_Array template used within the AP4_TrunAtom::Entry component of Bento4 before version 1.8.9. This vulnerability allows an attacker to cause a denial of service by supplying a specially crafted MP4 file that triggers the overflow. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high impact on availability. There is no vendor advisory or patch information available at this time.

Successful exploitation results in a denial of service condition by crashing the affected application processing the crafted MP4 file. There is no indication of confidentiality or integrity compromise. The attack requires local access and user interaction, limiting remote exploitation potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted MP4 files with affected versions of Bento4. Monitor vendor channels for updates regarding patches or mitigations.