What is the CVSS score of CVE-2026-36911?

CVE-2026-36911 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

MPC-BE CVE-2026-36911

EUVD-2026-41218 MEDIUM

Divide By Zero (CWE-369)

2026-07-01 mitre

GHSA-78wm-m59p-255g

Denial Of Service N A

5.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

File must be opened locally by the user (AV:L, UI:R); no privileges required to open files (PR:N); crash-only impact with no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:47 vuln.today

CVE Published

Jul 01, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Division-by-zero in MPC-BE's CStreamSwitcherOutputPin::DecideBufferSize crashes the media player when a victim opens a specially crafted MP4 file, resulting in a Denial of Service. Affected builds are those compiled before commit 4341cb3 from the Aleksoid1978 MPC-BE GitHub repository. No public exploit is confirmed as actively exploited (no CISA KEV listing), but SSVC indicates proof-of-concept code exists; EPSS at 0.15% (5th percentile) reflects very low real-world exploitation probability, and impact is strictly limited to application availability.

Technical ContextAI

MPC-BE (Media Player Classic - Black Edition) is an open-source DirectShow-based media player for Windows maintained by Aleksoid1978. The vulnerable function CStreamSwitcherOutputPin::DecideBufferSize is invoked during DirectShow filter graph construction to negotiate output buffer parameters when switching between streams. CWE-369 (Divide By Zero) identifies the root cause: an arithmetic operation uses an unchecked divisor that can be zero when parsing a malformed MP4 container, producing an unhandled exception and crashing the process. Because buffer negotiation occurs during the graph-build phase, the crash is triggered at file-open time, before media playback begins. No formal CPE string is registered for this product in the NVD dictionary (listed as n/a), but the GitHub repository at Aleksoid1978/MPC-BE is unambiguously the affected codebase, with the fix identified at commit 4341cb3.

RemediationAI

Users should update MPC-BE to a build compiled from commit 4341cb3 or later, which contains the upstream fix for the division-by-zero in CStreamSwitcherOutputPin::DecideBufferSize. The upstream fix is available in the Aleksoid1978/MPC-BE repository; however, a specific released version tag incorporating this commit is not independently confirmed from available data - users should consult the official MPC-BE releases page to identify the first release built from or after commit 4341cb3. As a compensating control prior to patching, avoid opening MP4 files from untrusted or unknown sources in MPC-BE. This workaround carries no meaningful trade-off as it restricts only untrusted input. The GitHub issue is at https://github.com/Aleksoid1978/MPC-BE/issues/1062.