← Vulnerability feed

Vulnerability record · CVE-2017-9126 · published 12 June 2017

CVE-2017-9126: Libquicktime memory buffer overflow vulnerability

LLibquicktime · Libquicktime

The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.

6.5 CVSS 3.0 Medium EPSS 4.0% · top 9.9% CWE-119 · Memory buffer overflow
6.5CVSS 3.0 base score, v2 4.3
4.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://usn.ubuntu.com/4545-1/
https://www.exploit-db.com/exploits/42148/ Third Party AdvisoryVDB Entry
https://usn.ubuntu.com/4545-1/
https://www.exploit-db.com/exploits/42148/ Third Party AdvisoryVDB Entry

Track CVE-2017-9126 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2016-2399Libquicktime integer overflow vulnerabilityInteger overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or poss…EPSS 7.2%6.5CVE-2017-12143Libquicktime improper input validation vulnerabilityIn libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c, which allows attackers to cause a deni…EPSS 1.0%6.5CVE-2017-12145Libquicktime improper input validation vulnerabilityIn libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which allows attackers to cause a denial of ser…EPSS 1.1%6.5CVE-2017-9122Libquicktime vulnerabilityThe quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumpt…EPSS 6.5%6.5CVE-2017-9123Libquicktime out-of-bounds read vulnerabilityThe lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read an…EPSS 3.8%6.5CVE-2017-9124Libquicktime null pointer dereference vulnerabilityThe quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and ap…EPSS 3.8%6.5CVE-2017-9125Libquicktime out-of-bounds read vulnerabilityThe lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over…EPSS 4.9%6.5CVE-2017-9127Libquicktime memory buffer overflow vulnerabilityThe quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buf…EPSS 5.1%

Source: NIST National Vulnerability Database (record CVE-2017-9126), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.