What is the CVSS score of CVE-2026-36910?

CVE-2026-36910 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

MPC-BE CVE-2026-36910

EUVD-2026-41217 MEDIUM

Buffer Overflow (CWE-119)

2026-07-01 mitre

GHSA-77h5-78m6-j9cj

Buffer Overflow Denial Of Service N A

5.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local file open required (AV:L), no privileges needed to run a media player (PR:N), but user must actively open the crafted file (UI:R); impact is crash only (A:H, C:N, I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:48 vuln.today

CVE Published

Jul 01, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Denial of Service in Aleksoid1978 MPC-BE exploits an access violation in the BaseSplitterFile::Read function when parsing a crafted MP4 file, crashing the media player. Any user of MPC-BE prior to commit 4341cb3 who opens a malicious MP4 is affected, with no network exposure - the attack is entirely local and requires user interaction. EPSS is 0.15% (5th percentile), reflecting low widespread exploitation probability; SSVC flags a POC as existing, and no CISA KEV listing is present.

Technical ContextAI

MPC-BE (Media Player Classic - Black Edition) is an open-source Windows media player maintained by Aleksoid1978. The vulnerability resides in BaseSplitterFile::Read, a function in the media splitter subsystem responsible for reading and demuxing MP4/ISO-BMFF container streams. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates the root cause is a memory bounds violation - likely an out-of-bounds read or write - triggered by malformed field values in a crafted MP4 file. A GitHub reference also points to the Bento4 MP4 toolkit (axiomatic-systems/Bento4 issue #873), which may indicate a dependency relationship between MPC-BE's splitter and Bento4 parsing logic, though this relationship is not explicitly confirmed in the available data. The CPE entry is unhelpfully catalogued as 'n/a:n/a' by NVD, meaning the affected product is not formally registered in the CPE dictionary.

RemediationAI

Update MPC-BE to a build incorporating commit 4341cb3 or later from the official repository at https://github.com/Aleksoid1978/MPC-BE. The upstream fix is available as a source commit (issue tracked at https://github.com/Aleksoid1978/MPC-BE/issues/1062); a tagged binary release version incorporating this fix has not been independently confirmed from the available data - users should verify the build date or commit hash of their installed version. As a compensating control where updating is not immediately possible, users should avoid opening MP4 files from untrusted sources in MPC-BE and configure their system to open MP4 files with an alternative media player by default. Blocking MP4 file delivery via email or file-sharing systems reduces the social engineering attack surface with no functional trade-off for most enterprise environments where media playback is non-critical.