What is the CVSS score of CVE-2026-36912?

CVE-2026-36912 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of MPC-BE are affected by CVE-2026-36912?

MPC-BE media player is vulnerable to denial-of-service attacks through specially formatted MP4 files, with publicly available exploit code and low attack likelihood (0.2% EPSS).

How to fix or mitigate CVE-2026-36912?

Within 24 hours: Inventory all MPC-BE installations and assess business-critical dependencies. Within 7 days: Notify affected users; recommend switching to alternative media players (VLC, Windows Media Player) or disabling autoplay features in MPC-BE. Within 30 days: Monitor Aleksoid1978 GitHub repository for patch release targeting commit 4341cb3 or later; establish deployment timeline upon patch availability.

MPC-BE CVE-2026-36912

EUVD-2026-41219 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-01 mitre

GHSA-4m73-g897-42fr

Denial Of Service Null Pointer Dereference N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

3.3 LOW

Crash triggers only when a user opens a crafted local file, so AV:L and UI:R; no confidentiality or integrity impact and a recoverable player crash yields A:L.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 17:01 vuln.today

CVSS changed

Jul 02, 2026 - 14:52 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

Jul 01, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Denial of service in Aleksoid1978 MPC-BE (Media Player Classic - Black Edition) prior to commit 4341cb3 lets an attacker crash the player by supplying a crafted MP4 file that triggers a NULL pointer dereference in the bundled Bento4 AP4_AtomSampleTable::GetSample() routine. A proof-of-concept is referenced (SSVC exploitation: poc), but there is no public exploit identified as weaponized and it is not in CISA KEV; impact is limited to availability with no code execution, data disclosure, or integrity loss. EPSS is low at 0.15% (5th percentile), consistent with a crash-only bug that requires a victim to open a malicious file.

Technical ContextAI

The flaw resides in the AP4_ (Bento4) MP4/ISO-BMFF demuxing code that MPC-BE embeds to parse sample tables. AP4_AtomSampleTable::GetSample() resolves a sample index against the underlying stbl (sample table) atoms such as stsc/stsz/stco/co64; a malformed MP4 can leave a required pointer unset, so the function dereferences NULL and the process crashes (CWE-476: NULL Pointer Dereference). The upstream root cause is tracked in Bento4 (axiomatic-systems/Bento4 issue #511) and surfaces in MPC-BE (Aleksoid1978/MPC-BE issue #1062) because MPC-BE consumes that parser. CPE data is unusable here (cpe:2.3:a:n/a:n/a:*), so the exact affected component must be read from the description and references rather than from NVD product enumeration.

RemediationAI

Update MPC-BE to a build that includes commit 4341cb3 or later, which addresses the NULL pointer dereference; this is an upstream fix available (commit) rather than an independently confirmed tagged release, so pull the fixed source or build from the project. If a patched build cannot be deployed immediately, the practical compensating control is to avoid opening untrusted or unsolicited MP4 files in MPC-BE and to not set MPC-BE as the default handler for MP4 content arriving via email or web, since exploitation requires processing an attacker-supplied file; the trade-off is reduced convenience in automatically opening media. Track fix status via https://github.com/Aleksoid1978/MPC-BE/issues/1062 and the upstream Bento4 issue https://github.com/axiomatic-systems/Bento4/issues/511. Because there is no confidentiality or integrity exposure and the worst case is a player crash, prioritization can be moderate.