What is the CVSS score of CVE-2026-36909?

CVE-2026-36909 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

MPC-BE CVE-2026-36909

EUVD-2026-41216 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-01 mitre

GHSA-2hw2-5mr3-w7wm

Null Pointer Dereference Denial Of Service N A

6.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Opening a crafted file in a desktop media player inherently requires user interaction, so UI:R is more accurate than the submitted UI:N; all other submitted metrics are retained.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:48 vuln.today

CVE Published

Jul 01, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Null pointer dereference in MPC-BE's MP4 parsing layer crashes the application when a crafted MP4 file is opened, resulting in a Denial of Service. The defect resides in AP4_TkhdAtom::GetTrackId() - a function inherited from the Bento4 media library used internally by MPC-BE - and is fixed in commit 4341cb3. No active exploitation is recorded (EPSS 0.15%, 5th percentile; not in CISA KEV), and SSVC assesses technical impact as only partial with no automatable exploitation path.

Technical ContextAI

MPC-BE (Media Player Classic - BE, maintained by Aleksoid1978) is a Windows-native audio/video player that incorporates the Bento4 library (by Axiomatic Systems) for ISO Base Media File Format (MP4/M4V/M4A) demuxing. The vulnerable function AP4_TkhdAtom::GetTrackId() is responsible for reading the track identifier from the Track Header Box (tkhd atom) in an MP4 container. CWE-476 (NULL Pointer Dereference) indicates that under certain malformed-file conditions the function is called on a null or uninitialized pointer - likely when a required tkhd atom is absent, structurally invalid, or references a zero-length payload - causing an unhandled dereference that terminates the process. The parallel GitHub issue filed against Bento4 directly (axiomatic-systems/Bento4 #965) confirms the root cause is in the shared library, not MPC-BE-specific code. The CPE string in the NVD data is a placeholder (cpe:2.3:a:n/a:n/a) and provides no version-range precision; affected scope must be inferred from the commit reference.

RemediationAI

The primary fix is to update MPC-BE to a build incorporating commit 4341cb3 or later, available from the official MPC-BE GitHub repository (github.com/Aleksoid1978/MPC-BE). No specific tagged release version is identified in the advisory data, so users should verify the build date or commit hash of their installation against 4341cb3. If an immediate update is not possible, the most practical compensating control is to avoid opening untrusted or externally sourced MP4 files in MPC-BE; organizations can enforce this via file-association policies or by restricting MPC-BE from processing files from untrusted network shares. Downstream users of the Bento4 library directly should monitor the upstream Bento4 issue tracker (github.com/axiomatic-systems/Bento4/issues/965) for an independent fix, as the vulnerability exists in shared library code. No vendor security advisory with a canonical fix version has been independently confirmed beyond the GitHub issue thread.