CVE-2026-36911
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Risk Assessment
An attacker can remotely crash the application, leading to disruption of the media player and potential user workflow interruption.
Recommendation
It is recommended to immediately update MPC-BE to a version containing commit 4341cb3 or later, which fixes this vulnerability.
Other vulnerabilities in MPC-BE
See all- CVE-2026-36912High
A NULL pointer dereference vulnerability was found in the AP4_AtomSampleTable::GetSample() function of MPC-BE before commit 4341cb3. An attacker can exploit a crafted MP4 file to cause a Denial of Service (DoS) by crashing the application.
- CVE-2026-36910Medium
An access violation in the BaseSplitterFile::Read function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2026-36909Medium
A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Original NVD description (English source)
A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.