CVE-2026-36912
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk5th percentile — higher than 5% of all known CVEs
Summary
A NULL pointer dereference vulnerability was found in the AP4_AtomSampleTable::GetSample() function of MPC-BE before commit 4341cb3. An attacker can exploit a crafted MP4 file to cause a Denial of Service (DoS) by crashing the application.
Risk Assessment
The risk is that a remote attacker can crash the application by providing a malicious MP4 file, leading to service disruption and loss of availability.
Recommendation
Immediately update MPC-BE to a version containing commit 4341cb3 or later. Also consider blocking unknown MP4 files at the firewall or antivirus level.
Original NVD description (English source)
A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.