CVE-2026-36909

MediumCVSS 6.2

Published: 01/07/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile — higher than 5% of all known CVEs

Summary

A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

Risk Assessment

The organization risks service disruption if a malicious MP4 file is processed by MPC-BE, potentially leading to availability loss.

Recommendation

Update MPC-BE to a version containing commit 4341cb3 or later. Avoid opening MP4 files from untrusted sources.

Original NVD description (English source)

A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.