CVE-2026-36910: MPC-BE MP4 Parser Access Violation DoS Vulnerability

Technical summary

CVE-2026-36910 is a heap or stack buffer access violation in the BaseSplitterFile::Read function within Aleksoid1978's MPC-BE media player. The vulnerability stems from inadequate bounds checking when parsing MP4 file structures. When a user opens a crafted MP4 file, the parser attempts to read beyond allocated buffer boundaries, triggering an access violation (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The issue was addressed in commit 4341cb3 of the MPC-BE repository. The vulnerability requires local file system access and user interaction to exploit, but no user privileges are needed beyond the ability to execute the application.

Business impact

Organizations that deploy MPC-BE for media playback—particularly in environments where users receive media files from external sources—face availability disruptions. A user opening a malicious MP4 file causes the player to crash, interrupting workflows. While this does not enable data theft or system compromise, repeated crashes degrade user experience and can be leveraged in denial-of-service scenarios. Media production teams, content review departments, and help desk environments where MP4 files are routinely opened are at higher risk.

Affected systems

Aleksoid1978 MPC-BE versions prior to commit 4341cb3 are affected. MPC-BE is a lightweight, open-source Windows media player. The vulnerability applies to all installations before the patched commit; users should verify the exact version number in their deployment against the official MPC-BE repository to determine if they are running a vulnerable build.

Exploitability

Exploitation requires local access and user interaction. An attacker must convince or socially engineer a user into opening a malicious MP4 file. The crafted file does not require special delivery methods—it can be sent via email, USB, or shared network drives. Once opened, the crash occurs automatically without further user action. The attack does not require elevated privileges, making it accessible to any threat actor capable of delivering a file to the target user. However, the impact is limited to denial of service; no code execution or privilege escalation is possible.

Remediation

Users should upgrade to a version of MPC-BE that includes commit 4341cb3 or later. Check the official MPC-BE GitHub repository for the latest build that incorporates this fix. In the interim, users can reduce risk by being cautious when opening MP4 files from untrusted sources and considering alternative media players for handling files of uncertain origin.

Patch guidance

Visit the official Aleksoid1978 MPC-BE GitHub repository and download a build dated after the fix commit (4341cb3). Pre-built binaries are typically available in the releases section. Verify the commit hash in the build metadata to confirm the fix is included. If using an automated deployment system, update the source commit pin or version selector to the patched version. No special configuration changes are required post-upgrade.

Detection guidance

Monitor for repeated application crashes of MPC-BE processes, particularly those triggered immediately after file-open operations. Log file access patterns for MP4 files arriving from external sources. In enterprise environments, endpoint detection and response (EDR) tools can flag unexpected crashes of the MPC-BE process. Consider implementing file integrity monitoring on media directories to identify when suspicious or malformed MP4 files are introduced. If MPC-BE is not required in your environment, consider removing or replacing it with a more actively maintained alternative.

Why prioritize this

While the CVSS score of 5.5 reflects a medium severity, prioritize patching in environments where MPC-BE is widely deployed or where users regularly handle media files from external parties. The attack surface is broad due to the ubiquity of MP4 files. However, this is not a critical vulnerability; organizations without MPC-BE in their environment or those using media players for internal content only face lower risk.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects a local attack vector with low complexity, no privileges required, and user interaction needed. The impact is limited to availability (high) with no confidentiality or integrity compromise. The score would be higher if remote exploitation were possible, but the requirement for local file access and user interaction constrains the severity. The vulnerability is real but not of critical concern for most organizations.

Frequently asked questions