rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-70082 
An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-70083 
An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The program copies DirName into the local buffer DirWithSep using strcpy. The size of this buffer is OS_MAX_PATH_LEN. If the length of DirName is greater than or equal to OS_MAX_PATH_LEN, a stack buffer overflow occurs, overwriting adjacent stack memory. The path length check (FileUtil_AppendPathSep) is performed after the strcpy operation, meaning the validation occurs too late and cannot prevent the overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2025-70084 
Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via crafted value to the FileUtil_GetFileInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2025-70085 
An issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes. The code uses sprintf to format two filenames (Source1Filename and the string returned by FileUtil_FileStateStr) into this buffer without any length checking and without using bounded format specifiers such as %.*s. If the filename length approaches OS_MAX_PATH_LEN (commonly 64-256 bytes), the combined formatted string together with constant text can exceed 256 bytes, resulting in a stack buffer overflow. Such unsafe sprintf calls are scattered across multiple functions in file.c, including FILE_ConcatenateCmd() and ConcatenateFiles(), all of which fail to validate the output length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2025-70091 
A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Phone Number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-13T00:00:00.000Z
CVE-2025-70092 
A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-12T00:00:00.000Z
CVE-2025-70093 
An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-13T00:00:00.000Z
CVE-2025-70094 
A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-13T00:00:00.000Z
CVE-2025-70095 
A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-13T00:00:00.000Z
CVE-2025-70099 
A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supplying a specially crafted EXT4 filesystem image with malformed directory entries. During directory iteration, the code may fail to validate the directory entry pointer before accessing the name_len field, resulting in a segmentation fault. This affects versions based on (or equivalent to) the 2016-era codebase (1.0.0).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2025-70100 
A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by providing a malformed ext4 filesystem image that results in a zero logical block size. The vulnerability is triggered during mount or image processing and leads to a Floating-Point Exception (FPE) under sanitizers or a runtime crash in standard builds due to missing validation of lb_size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2025-70101 
An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by supplying a specially crafted ext4 filesystem image. The vulnerability occurs due to insufficient validation of extent header fields before performing a binary search over extent index entries, which can result in invalid pointer calculations and an out-of-bounds memory read during extent tree traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2025-70103 
Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2025-70116 
A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g., codec/mime/profile strings). gf_media_map_esd then calls strlen() on a NULL pointer, triggering a crash (ASan SEGV).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2025-70121 
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted 5GS Mobile Identity in a NAS Registration Request message. The issue occurs in the GetSUCI method (NAS_MobileIdentity5GS.go) when accessing index 5 of a 5-element array, leading to a runtime panic and AMF crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-13T00:00:00.000Z
CVE-2025-70122 
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request. The issue occurs in the SDFFilterFields.UnmarshalBinary function (sdf-filter.go) when processing a declared length that exceeds the actual buffer capacity, leading to a runtime panic and UPF crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-13T00:00:00.000Z
CVE-2025-70123 
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. The UPF incorrectly accepts a malformed PFCP Association Setup Request, violating 3GPP TS 29.244. This places the UPF in an inconsistent state where a subsequent valid PFCP Session Establishment Request triggers a cascading failure, disrupting the SMF connection and causing service degradation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-13T00:00:00.000Z
CVE-2025-70128 
A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the "link" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's "Comments" section when administrators review submitted comments. Importantly, the malicious script is not reflected in the public-facing comments interface, but only within the backend administration view. Alternatively, users of Administrator, Moderator, Manager roles can also directly input crafted payloads into existing comments. This makes the vulnerability a persistent XSS issue targeting administrative users. This affects /core/admin/comments.php, while CVE-2022-24585 affects /core/admin/comment.php, a uniquely distinct vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70129 
If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70141 
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70146 
Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting records) via direct HTTP requests to affected endpoints without a valid session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70147 
Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET requests to these endpoints without a valid session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70148 
Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure direct object reference (IDOR).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70149 
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70150 
CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70151 
code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it from /uploads/, an attacker can execute arbitrary PHP code as the web server user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70152 
code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2026-02-18T00:00:00.000Z
CVE-2025-70161 
EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without proper sanitization. An attacker can exploit this by injecting malicious commands into the pppUserName field, allowing arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-70218 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70219 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70220 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70221 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70222 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70223 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70225 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70226 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-70227 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the nextPage parameter to goform/formLanguageChange.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70229 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSchedule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2025-70230 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDDNS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2025-70231 
D-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST requests related to verification codes in /goform/formLogin, it enters /goform/getAuthCode but fails to filter the value of the FILECODE parameter, resulting in a path traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2025-70232 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2025-70233 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetEnableWizard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2025-70234 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2025-70236 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2025-70237 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2025-70238 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard52.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-09T00:00:00.000Z
CVE-2025-70239 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard55.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2025-70240 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2025-70241 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2025-70242 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formSetWanPPTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70243 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard534.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-09T00:00:00.000Z
CVE-2025-70244 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formWlanSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70245 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2025-70246 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formVirtualServ.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70247 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70249 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70250 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formdumpeasysetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-09T00:00:00.000Z
CVE-2025-70251 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formWlanGuestSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2025-70252 
An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2025-70296 
A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2025-70297 
A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2025-70298 
GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-70299 
A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-70302 
A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-70303 
A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z