This vulnerability in Axiomatic Bento4 up to version 1.6.0-641 involves a heap-based buffer overflow in the AP4_BitReader::SkipBits function of the DSI v1 Parser component. Specifically, improper handling of the n_presentations argument allows an attacker with local access to cause memory corruption by overflowing a heap buffer. The vulnerability has a CVSS 4.8 (medium) score, reflecting the requirement for local privileges and limited impact. No official patch or vendor advisory is currently available, and the vendor has not responded to the issue report. Public exploit code exists, but no exploitation in the wild is confirmed.

Successful exploitation can lead to heap memory corruption, which may cause application crashes or potentially enable further local privilege escalation or code execution. However, the attack requires local access and privileges, limiting the scope and ease of exploitation. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for suspicious activity related to Bento4 usage. Avoid running vulnerable versions in untrusted environments until an official fix is available.