What is the CVSS score of CVE-2026-36912?

CVE-2026-36912 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of MPC-BE are affected by CVE-2026-36912?

MPC-BE media player is vulnerable to denial-of-service attacks through specially formatted MP4 files, with publicly available exploit code and low attack likelihood (0.2% EPSS).

How to fix or mitigate CVE-2026-36912?

Within 24 hours: Inventory all MPC-BE installations and assess business-critical dependencies. Within 7 days: Notify affected users; recommend switching to alternative media players (VLC, Windows Media Player) or disabling autoplay features in MPC-BE. Within 30 days: Monitor Aleksoid1978 GitHub repository for patch release targeting commit 4341cb3 or later; establish deployment timeline upon patch availability.

MPC-BE CVE-2026-36912

EUVD-2026-41219 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-01 mitre

GHSA-4m73-g897-42fr

Denial Of Service Null Pointer Dereference N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

3.3 LOW

Crash triggers only when a user opens a crafted local file, so AV:L and UI:R; no confidentiality or integrity impact and a recoverable player crash yields A:L.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 17:01 vuln.today

CVSS changed

Jul 02, 2026 - 14:52 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

Jul 01, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Denial of service in Aleksoid1978 MPC-BE (Media Player Classic - Black Edition) prior to commit 4341cb3 lets an attacker crash the player by supplying a crafted MP4 file that triggers a NULL pointer dereference in the bundled Bento4 AP4_AtomSampleTable::GetSample() routine. A proof-of-concept is referenced (SSVC exploitation: poc), but there is no public exploit identified as weaponized and it is not in CISA KEV; impact is limited to availability with no code execution, data disclosure, or integrity loss. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malformed MP4 with corrupt sample table

Delivery

Deliver file to victim

Exploit

Victim opens file in MPC-BE

Execution

Parser calls GetSample()

Persist

NULL pointer dereference

Impact

Player process crashes (DoS)

Access

Craft malformed MP4 with corrupt sample table

Delivery

Deliver file to victim

Exploit

Victim opens file in MPC-BE

Execution

Parser calls GetSample()

Persist

NULL pointer dereference

Impact

Player process crashes (DoS)

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to open an attacker-crafted MP4 file in a vulnerable MPC-BE build (before commit 4341cb3) so that the embedded Bento4 parser reaches AP4_AtomSampleTable::GetSample() with a malformed sample table. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malformed MP4 whose sample-table atoms leave a pointer unset, then delivers it to a victim via download, email attachment, or an embedded link. When the victim opens the file in a vulnerable MPC-BE build, AP4_AtomSampleTable::GetSample() dereferences NULL and the player crashes. …
Remediation	Update MPC-BE to a build that includes commit 4341cb3 or later, which addresses the NULL pointer dereference; this is an upstream fix available (commit) rather than an independently confirmed tagged release, so pull the fixed source or build from the project. … Detailed patch versions, workarounds, and compensating controls in full report.