CVE-2026-36912
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A NULL pointer dereference vulnerability was found in the AP4_AtomSampleTable::GetSample() function of MPC-BE before commit 4341cb3. An attacker can exploit a crafted MP4 file to cause a Denial of Service (DoS) by crashing the application.
Risk Assessment
The risk is that a remote attacker can crash the application by providing a malicious MP4 file, leading to service disruption and loss of availability.
Recommendation
Immediately update MPC-BE to a version containing commit 4341cb3 or later. Also consider blocking unknown MP4 files at the firewall or antivirus level.
Other vulnerabilities in MPC-BE
See all- CVE-2026-36911Medium
A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2026-36910Medium
An access violation in the BaseSplitterFile::Read function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2026-36909Medium
A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Original NVD description (English source)
A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.