MPC-BE CVE-2026-36912

Exploitation requires the victim to open an attacker-crafted MP4 file in a vulnerable MPC-BE build (before commit 4341cb3) so that the embedded Bento4 parser reaches AP4_AtomSampleTable::GetSample() with a malformed sample table. Limiting factors: the attacker must get the malicious file to the target and the user must actually play it in MPC-BE (user interaction plus local file processing), which contradicts the input vector's AV:N/UI:N; there is no privilege or authentication requirement, and the outcome is confined to crashing the player process with no code execution or data access. The input CVSS marks this AV:N/UI:N, but the description ('via a crafted MP4 file') indicates local file handling with user interaction - verify with vendor.

Signals are mixed. The input CVSS 3.1 base score is 7.5 (High) via AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but that vector is internally questionable for a media-player file-parsing bug: AV:N with UI:N implies remote, no-interaction exploitation, whereas a crafted MP4 realistically must be delivered to and opened by a user, which points to AV:L and UI:R - verify with vendor. SSVC lists Exploitation=poc, Automatable=yes, Technical Impact=partial, EPSS is only 0.15% (5th percentile), and there is no KEV listing. Taken together this is a low-to-moderate real-world priority: a genuine, POC-backed crash with no confidentiality or integrity impact and only application-level availability loss, not a network-exploitable RCE. The 7.5 rating overstates urgency for most environments.

An attacker crafts a malformed MP4 whose sample-table atoms leave a pointer unset, then delivers it to a victim via download, email attachment, or an embedded link. When the victim opens the file in a vulnerable MPC-BE build, AP4_AtomSampleTable::GetSample() dereferences NULL and the player crashes. A proof-of-concept is referenced, and given AC:L the crash is reliably reproducible, but impact is limited to denial of service.