CVE-2026-36909: MPC-BE Media Player DoS Vulnerability

CVE-2026-36909 Overview

CVE-2026-36909 is a NULL pointer dereference vulnerability in Aleksoid1978 MPC-BE, a Windows media player derived from Media Player Classic. The flaw resides in the AP4_TkhdAtom::GetTrackId() function, which is part of the Bento4 MP4 parsing library integrated into MPC-BE. Attackers can trigger the vulnerability by convincing a user to open a crafted MP4 file, causing the application to crash. The issue affects builds prior to commit 4341cb3. The vulnerability is classified under CWE-476 (NULL Pointer Dereference).

Critical Impact
A crafted MP4 file causes MPC-BE to dereference a NULL pointer inside the Track Header Atom (tkhd) parser, resulting in application termination and denial of service for the media player process.

Affected Products

Aleksoid1978 MPC-BE versions prior to commit 4341cb3
Bento4 MP4 parsing library (AP4_TkhdAtom component) as embedded in MPC-BE
Downstream builds and forks incorporating the unpatched Bento4 code

Discovery Timeline

2026-07-01 - CVE-2026-36909 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-36909

Vulnerability Analysis

The vulnerability exists in the AP4_TkhdAtom::GetTrackId() function, which returns the track identifier field from an MP4 Track Header Atom. MPC-BE uses the Bento4 library to parse ISO Base Media File Format containers such as MP4. When a malformed MP4 file omits or corrupts the expected tkhd atom structure, the parser fails to allocate or link the associated atom object. Subsequent calls to GetTrackId() operate on a NULL pointer, triggering an access violation.

The process crashes when the invalid dereference occurs during container demuxing. Because MPC-BE runs the parser in-process, the entire media player terminates. The vulnerability requires local user interaction, since the attacker must deliver the crafted file and induce playback.

Root Cause

The root cause is missing validation of the tkhd atom pointer before member access. The Bento4 parser assumes the atom object exists once the enclosing track container is instantiated. When the malformed input omits or malforms the track header, this assumption breaks and the code dereferences NULL. This pattern matches CWE-476. Related upstream discussion appears in Bento4 GitHub Issue #965 and MPC-BE GitHub Issue #1062.

Attack Vector

Exploitation requires local file interaction. An attacker crafts an MP4 file with malformed atom structures and delivers it through email, download, removable media, or a network share. When the victim opens the file in a vulnerable MPC-BE build, the parser reaches AP4_TkhdAtom::GetTrackId() with a NULL object pointer and the player crashes. The vulnerability does not enable code execution or data disclosure; impact is limited to availability of the media player process.

No verified public proof-of-concept code is available. See the linked GitHub issues for technical crash details.

Detection Methods for CVE-2026-36909

Indicators of Compromise

Unexpected termination of mpc-be64.exe or mpc-be.exe shortly after opening an MP4 file
Windows Error Reporting (WER) crash dumps referencing AP4_TkhdAtom::GetTrackId in the faulting stack
Application Error events (Event ID 1000) in the Windows Application log naming MPC-BE with an access violation exception code 0xC0000005

Detection Strategies

Hunt for repeated MPC-BE process crashes across endpoints, correlated with recently opened MP4 files
Inspect MP4 files for missing or malformed tkhd atoms using file-format validators before distribution or playback
Monitor endpoint telemetry for MPC-BE spawning WER handlers such as WerFault.exe following media file access

Monitoring Recommendations

Enable Windows Application and Application Error event forwarding to a centralized log store for crash analysis
Track file execution and open events for .mp4 files delivered from external sources such as email and web downloads
Alert on high-frequency MPC-BE crash patterns that may indicate targeted delivery of malformed media

How to Mitigate CVE-2026-36909

Immediate Actions Required

Update MPC-BE to a build that includes commit 4341cb3 or later
Restrict opening MP4 files from untrusted sources until the update is deployed
Verify integrity of MP4 assets sourced from external partners before distribution to end users

Patch Information

The vulnerability is fixed in Aleksoid1978 MPC-BE commit 4341cb3. Users should install a nightly or release build that incorporates this commit. Refer to MPC-BE GitHub Issue #1062 and Bento4 GitHub Issue #965 for upstream fix references.

Workarounds

Do not open MP4 files received from untrusted or unverified sources
Use an alternative media player for MP4 playback until MPC-BE is updated
Apply application allowlisting policies to prevent execution of unknown media files in high-risk environments

bash

# Verify installed MPC-BE version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\MPC-BE\Settings" | Select-Object VersionMajor, VersionMinor, VersionPatch