CVE-2026-36909: MPC-BE NULL Pointer Dereference Denial of Service via Crafted MP4

Technical summary

CVE-2026-36909 is a NULL pointer dereference vulnerability (CWE-476) located in the AP4_TkhdAtom::GetTrackId() function of MPC-BE. This function is responsible for extracting track ID information from the Track Header atom in MP4 container files. When processing a crafted MP4 file that lacks or malforms the expected data structure, the function attempts to dereference a NULL pointer without proper validation, resulting in an unhandled exception that crashes the application. The vulnerability requires local file access and no user privileges beyond the ability to open files, making it trivial to trigger via a malicious MP4 distributed through email, file sharing, or web download.

Business impact

Organizations and users relying on MPC-BE for video content review, editing, or playback face potential availability disruption. In enterprise environments where automated media processing pipelines use MPC-BE, a malicious MP4 could halt workflows. While the impact is limited to denial of service (no data theft or system compromise), the ability to crash the player on demand could be weaponized in scenarios where media playback reliability is critical—such as broadcast environments, content moderation workflows, or automated transcoding pipelines. The ease of exploitation and distribution via ordinary MP4 files elevates the practical risk.

Affected systems

MPC-BE (Media Player Classic - Black Edition) versions prior to commit 4341cb3 are affected. MPC-BE is available on Windows platforms and is used by media professionals, enthusiasts, and organizations for video playback and editing. The vulnerability affects all build versions shipped before the patched commit. Users should verify the exact version or commit hash of their installation against the project's repository to confirm whether they are running vulnerable code.

Exploitability

This vulnerability is straightforward to exploit. An attacker needs only to craft an MP4 file with a malformed Track Header atom—a task requiring basic knowledge of the MP4 file format specification—and distribute it to the target. No interaction with the system beyond opening the file in MPC-BE is necessary; no special user privileges, network access, or social engineering are required once the file is on the victim's system. The CVSS score of 6.2 reflects the ease of exploitation (CVSS:3.1/AV:L/AC:L/PR:N/UI:N) tempered by the fact that impact is limited to availability rather than confidentiality or integrity. An attacker could deliver the malicious file via email, collaboration platforms, torrent sites, or any vector for distributing MP4 files.

Remediation

Update MPC-BE to a version that includes commit 4341cb3 or later. Users should check the project's official repository and release notes to identify the first release containing this fix. Alternatively, apply the patch directly if building from source. Given the low privilege barrier to exploitation, patching should be prioritized for any system regularly processing untrusted media files. There is no known workaround short of avoiding opening untrusted MP4 files or restricting access to the media player.

Patch guidance

Obtain the latest MPC-BE release from the official Aleksoid1978 project repository (verify the commit hash to confirm it includes or supersedes 4341cb3). If you manage MPC-BE installations across multiple machines, coordinate a staged rollout to ensure media workflows remain uninterrupted. For users compiling from source, cherry-pick or merge the fix commit into your build. Test the patched version with your standard media library to confirm no playback regressions. If MPC-BE is embedded in third-party applications or scripts, coordinate with those vendors for updates as well.

Detection guidance

Monitor for application crashes tied to MP4 file processing. Log or alert on instances of MPC-BE terminating unexpectedly, especially during media library scans or batch operations. If you maintain file integrity monitoring (FIM) or media analysis pipelines, observe for unusual MP4 files with truncated or malformed tkhd atoms—tools like MediaInfo or custom MP4 parsers can inspect file structure. In network environments, inspect file uploads or downloads for MP4 files originating from untrusted sources and validate them before playback. Consider blocking or quarantining MP4 files from suspicious origins pending patch deployment.

Why prioritize this

Although the CVSS score is moderate (6.2), the vulnerability merits swift remediation due to three factors: (1) trivial exploitability—no special privileges, interaction, or technical sophistication required; (2) ease of distribution—MP4 files are ubiquitous and can be shared via nearly any channel; and (3) operational impact in media-heavy workflows. Organizations running MPC-BE in automated media processing, content review, or broadcast environments should prioritize this patch to prevent disruption. For casual users, the risk is lower but still warrants updating within a reasonable cycle.

Risk score, explained

The CVSS 3.1 score of 6.2 (MEDIUM) reflects a vulnerability with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), offset by local-only attack vector (AV:L) and impact limited to availability (A:H, but C:N and I:N). The score appropriately captures the ease and feasibility of exploitation balanced against the contained scope of impact. In risk prioritization, consider that ease of exploitation pushes practical risk slightly higher than the base score suggests; however, the lack of integrity or confidentiality impact prevents a higher severity rating.

Frequently asked questions