CVE-2026-36911: MPC-BE Division-by-Zero DoS Vulnerability – CVSS 5.5 Medium

Technical summary

CVE-2026-36911 is a division-by-zero arithmetic exception in the CStreamSwitcherOutputPin::DecideBufferSize function within Aleksoid1978's MPC-BE media player. The vulnerability stems from insufficient input validation when processing MP4 file headers. When DecideBufferSize performs a calculation that divides by a zero value derived from crafted file metadata, an unhandled exception occurs, causing immediate process termination. The flaw affects MPC-BE versions prior to commit 4341cb3, which implements bounds checking on the divisor before the operation.

Business impact

For organizations that standardize on MPC-BE or distribute it to users, this vulnerability creates a denial-of-service vector. An attacker can distribute a weaponized MP4 file via email, file-sharing platforms, or compromised websites, causing MPC-BE to crash whenever a user attempts to play it. While not a data breach or system compromise risk, repeated crashes degrade user productivity and could be chained with social engineering (e.g., 'video file failed to play, click here for codec update') to deliver secondary payloads. Organizations relying on MPC-BE for media transcoding or playback pipelines should treat this as an operational availability concern.

Affected systems

MPC-BE (Media Player Classic - Black Edition) prior to commit 4341cb3 is vulnerable. MPC-BE is a community-maintained fork of the original Media Player Classic, widely used on Windows systems by power users, media professionals, and organizations needing lightweight playback with advanced codec support. The vulnerability is triggered only when a user attempts to open a malicious MP4 file, so exposure depends on file handling practices and user awareness.

Exploitability

Exploitability is moderate. The attack requires user interaction—specifically, opening a crafted MP4 file in a vulnerable version of MPC-BE. An attacker cannot exploit this remotely without first compromising a system or tricking a user into downloading the file. No authentication or elevated privileges are needed. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects local attack surface, low complexity, no privileges required, but mandatory user interaction. Public exploit code is not known to exist, but the division-by-zero condition is straightforward to reproduce once the triggering MP4 structure is identified.

Remediation

Update MPC-BE to a version incorporating commit 4341cb3 or later. This commit adds validation logic that ensures the divisor is non-zero before performing the calculation in DecideBufferSize. Users should check the official Aleksoid1978 MPC-BE repository (GitHub) for the latest release. Until patching is possible, users should avoid opening MP4 files from untrusted sources and consider disabling MPC-BE as the default handler for MP4 files in environments where file provenance is uncertain.

Patch guidance

Verify the version of MPC-BE installed by checking Help > About or the executable properties. Compare the commit hash or release version against the official Aleksoid1978 repository to confirm commit 4341cb3 or a later build is deployed. For automated environments, check the build timestamp or version string; patched builds will include a fix label or higher version number. If MPC-BE is distributed via organizational package management, update the deployment package and redeploy to affected systems. End-user systems should be prompted to update via the MPC-BE internal update mechanism or manual download from the official source.

Detection guidance

Monitor for repeated MPC-BE process crashes or unexpected termination events in application logs. Endpoint Detection and Response (EDR) tools can flag suspicious MP4 file downloads followed by immediate MPC-BE crashes, suggesting exploitation attempts. Network-level detection is limited since the vulnerability is triggered locally, but security teams can scan inbound file transfers for MP4 files with anomalous headers (e.g., zero-valued size or duration fields in specific atoms). File integrity monitoring can help identify when new MP4 files appear in user directories and correlate with crash events. User reports of 'video won't play' should be triaged to confirm whether a crash dump or event log entry indicates a division-by-zero exception.

Why prioritize this

This vulnerability warrants medium priority in most environments due to its denial-of-service impact and reliance on user interaction. However, organizations should elevate priority if: (1) MPC-BE is mission-critical for media workflows; (2) users frequently receive or share video files from external parties; (3) the organization has limited ability to rapidly patch desktop applications. The absence of data exfiltration, code execution, or privilege escalation risk keeps it from critical tier, but the ease of trigger and potential for user frustration justify timely remediation.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector with low complexity and no privilege requirement, but mandatory user interaction and high availability impact. The score appropriately captures that this is a nuisance vulnerability for most users (crashing an application) rather than a system-wide security breach. Organizationally, the risk is elevated if MPC-BE availability is contractually or operationally critical, or if the user base is targeted by social engineering campaigns that combine malicious video files with credential harvesting.

Frequently asked questions