CVE-2018-14326

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing...

8.8 High

CVE-2018-14326 is a high vulnerability (CVSS 8.8) in Techsmith Mp4v2, published July 16, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. No source names a fixed version.

What does this mean?

Severity: 8.8 HighCVSS 3.0, NVD
Exploit chance: 1.86%EPSS, 79th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.86%Up 1.0 points since Apr 14, 2021

Affected products

techsmith mp4v2

Affected packages

Affected packages
Package	Affected	Fixed
`libmp4v2` Mageia:7 From an advisory covering 5 CVEs	before 2.1.0-0.4.mga7	2.1.0-0.4.mga7
`mp4v2` Ubuntu:16.04:LTS	All versions, plus listed versions 2.0.0~dfsg0-32.0.0~dfsg0-4	None known
`mp4v2` Ubuntu:18.04:LTS	All versions, plus listed versions 2.0.0~dfsg0-6	None known

What each source reports

NVD Score used8.8

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

Record: CVE-2018-14326
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-190
Updated: 2026-11-02

CVE ListNo score

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

Record: CVE-2018-14326
Updated: 2026-11-02

EUVDEUVD-2018-6248No score

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

Record: EUVD-2018-6248
Updated: 2026-11-03

GitHub AdvisoriesGHSA-h65m-rp7h-3qgc8.8

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing...

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

Record: GHSA-h65m-rp7h-3qgc
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSV8.8

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

Record: CVE-2018-14326
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-143268.8

In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

Record: UBUNTU-CVE-2018-14326
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2020-0062No score

Updated libmp4v2 packages fix security vulnerabilities

Updated libmp4v2 packages fix security vulnerabilities:

The libmp4v2 library through version 2.1.0 is vulnerable to an integer underflow when parsing an MP4Atom in mp4atom.cpp. An attacker could exploit this to cause a denial of service via crafted MP4 file (CVE-2018-14325).

The libmp4v2 library through version 2.1.0 is vulnerable to an integer overflow and resultant heap-based buffer overflow when resizing an MP4Array for the ftyp atom in mp4array.h. An attacker could exploit this to cause a denial of service via crafted MP4 file (CVE-2018-14326).

MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted MP4 file, because access to the data structure has different expectations about layout as a result of this type confusion (CVE-2018-14379).

MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access (CVE-2018-14403).

MP4Integer32Property::Read in atom_avcC.cpp in MP4v2 2.1.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted MP4 file (CVE-2018-14446).

Record: MGASA-2020-0062
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 9 moreShow less