CVE-2026-36912: MPC-BE MP4 NULL Pointer DoS Vulnerability – Patch Guidance

Technical summary

CVE-2026-36912 is a NULL pointer dereference vulnerability in the AP4_AtomSampleTable::GetSample() function within Aleksoid1978's MPC-BE media player. When processing a crafted MP4 container file, the function fails to validate pointer state before dereferencing, resulting in a null reference condition. This triggers an unhandled exception that crashes the application. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and can be exploited remotely via a maliciously constructed MP4 file without requiring authentication or user privileges beyond opening the file.

Business impact

MPC-BE users who encounter a malicious MP4 file—whether via email, web download, or file sharing—risk immediate service disruption as the player crashes. For organizations using MPC-BE in automated media processing workflows, streaming quality assurance, or content distribution environments, this vulnerability can disrupt batch operations and monitoring. The attack requires no social engineering; a link or attachment is sufficient. While no data theft or system compromise occurs, the denial of service can affect productivity and availability of media-dependent services.

Affected systems

Aleksoid1978 MPC-BE versions prior to commit 4341cb3 are affected. Users should consult the MPC-BE project repository or release notes to identify which version numbers correspond to or post-date this commit. The vulnerability is specific to the MPC-BE application; other media players using different codebases are not affected. Systems running MPC-BE on Windows (the primary platform for this player) are at risk if they process untrusted or user-supplied MP4 files.

Exploitability

Exploitation is straightforward: an attacker crafts an MP4 file with a malformed sample table structure, then distributes it via email, website, file-sharing platform, or social engineering. When a victim opens the file in MPC-BE, the application immediately crashes. No user interaction beyond file opening is required, and the attacker requires no network access, authentication, or elevated privileges. The attack surface is broad because MP4 is a common container format and users routinely open media files from various sources. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects this accessibility: network attack, low complexity, no privileges needed, minimal user interaction.

Remediation

Update MPC-BE to a version that includes or post-dates commit 4341cb3. Check the official MPC-BE repository and release notes to confirm the patched version number and availability. There is no known workaround; users must upgrade. During transition, exercise caution when opening MP4 files from untrusted sources. If MPC-BE crashes on a specific file, treat it as a potential indicator of a malicious payload and isolate the file.

Patch guidance

Verify against the official Aleksoid1978 MPC-BE repository (GitHub or project site) for the specific release version that includes commit 4341cb3. Download and install the patched version, ensuring it is obtained from an official source. On Windows, uninstall the old version before installing the new one, or allow the installer to overwrite in-place. No special configuration changes are required post-patch. Test with known-good MP4 files to confirm normal playback is restored.

Detection guidance

Monitor MPC-BE crash logs and event viewer entries for unhandled exceptions in AP4_AtomSampleTable::GetSample() or related LibAtom functions. Identify and quarantine MP4 files that reliably trigger crashes; these are strong indicators of malicious sample table structures. Network detection is limited unless files are analyzed in transit (e.g., email gateway content inspection with MP4 parsing). Endpoint detection and response (EDR) tools can flag unexpected MPC-BE process terminations. In media processing pipelines, implement integrity checks or validation of MP4 files before feeding them to MPC-BE.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score (7.5) and ease of exploitation. While limited to DoS and not involving confidentiality or integrity compromise, the attack requires no barriers to entry—any user can be targeted with a malicious MP4. Organizations relying on MPC-BE for media operations should prioritize patching to restore stability. The lack of KEV designation suggests limited in-the-wild exploitation at present, but the accessibility of the attack vector means adoption of exploits could increase without immediate visibility.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated attack with no user interaction required, resulting in high availability impact. The vulnerability does not expose confidential data or allow system integrity violations, which would elevate the score further. The score is proportional to the risk: wide attack surface, simple exploit path, and significant operational disruption, but contained blast radius (single application, not full system compromise). Organizations should treat this as a timely but not critical emergency patch.

Frequently asked questions