CVE-2026-36910
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An access violation in the BaseSplitterFile::Read function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Risk Assessment
An attacker can remotely crash the application, disrupting its availability and potentially affecting users who rely on the player for multimedia processing.
Recommendation
Immediately update MPC-BE to a version containing commit 4341cb3 or later to mitigate the DoS vulnerability from malicious MP4 files.
Other vulnerabilities in MPC-BE
See all- CVE-2026-36912High
A NULL pointer dereference vulnerability was found in the AP4_AtomSampleTable::GetSample() function of MPC-BE before commit 4341cb3. An attacker can exploit a crafted MP4 file to cause a Denial of Service (DoS) by crashing the application.
- CVE-2026-36911Medium
A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2026-36909Medium
A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Original NVD description (English source)
An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.