CVE-2026-36910: MPC-BE Media Player DoS Vulnerability

CVE-2026-36910 Overview

CVE-2026-36910 is a memory corruption vulnerability in Aleksoid1978 MPC-BE, an open-source media player for Windows. The flaw resides in the BaseSplitterFile::Read function and is triggered when the application parses a crafted MP4 file. Processing the malformed input causes an access violation that terminates the player process, resulting in a Denial of Service (DoS). The issue is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer. Exploitation requires local file access and user interaction, since a target must open the malicious media file. The vulnerability is fixed in commits following 4341cb3.

Critical Impact
A crafted MP4 file causes an access violation in MPC-BE, crashing the media player and disrupting availability on the local host.

Affected Products

Aleksoid1978 MPC-BE (Media Player Classic - Black Edition)
MPC-BE builds prior to commit 4341cb3
Bento4 library components referenced in the upstream parser (see external references)

Discovery Timeline

2026-07-01 - CVE-2026-36910 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-36910

Vulnerability Analysis

MPC-BE relies on the BaseSplitterFile::Read function to read bytes from media containers during demuxing. When the player opens a crafted MP4 file, malformed box sizes or offsets steer BaseSplitterFile::Read into an out-of-bounds memory access. The resulting access violation is unhandled and terminates the player process.

The issue is a memory safety bug tracked as [CWE-119]. Exploitation does not yield code execution, information disclosure, or integrity impact based on the published vector. Attackers gain only an availability impact against the user running MPC-BE.

Because the attack vector is local and requires the user to open the file, mass exploitation is unlikely. However, the flaw is useful in targeted phishing scenarios where a lure media file is delivered by email, chat, or shared drives.

Root Cause

The root cause is insufficient bounds validation inside BaseSplitterFile::Read when handling attacker-controlled length and offset fields from MP4 atoms. The function trusts container metadata and reads beyond a valid buffer boundary. The upstream project fixed the defect in commit 4341cb3 by tightening the read logic. Related parsing weaknesses are also discussed in the Bento4 project tracker referenced by the CVE.

Attack Vector

An attacker crafts an MP4 file with malformed structural fields and delivers it to the target. The victim opens the file with a vulnerable MPC-BE build, and the demuxer invokes BaseSplitterFile::Read on the malicious data. The access violation crashes the player. Attack complexity is low, no privileges are required, but user interaction is mandatory.

The vulnerability manifests during container parsing before decoding begins. See the MPC-BE GitHub Issue #1062 and the Bento4 GitHub Issue #873 for reproduction details.

Detection Methods for CVE-2026-36910

Indicators of Compromise

Unexpected termination of mpc-be.exe or mpc-be64.exe shortly after opening an MP4 file.
Windows Application event log entries recording an access violation (exception code 0xC0000005) in the MPC-BE process.
Presence of untrusted .mp4 files delivered via email attachments, chat platforms, or removable media prior to the crash.

Detection Strategies

Correlate Windows Error Reporting (WER) crash telemetry against MPC-BE process names and the faulting module associated with the splitter.
Hunt for MP4 files with anomalous atom sizes or truncated moov/mdat structures at ingress points such as mail gateways and file shares.
Alert on repeated MPC-BE process terminations across multiple endpoints, which may indicate a distributed lure campaign.

Monitoring Recommendations

Forward endpoint process termination and crash events to a central log platform for correlation.
Inspect media files downloaded from external sources with a sandboxed player before user distribution.
Track the installed MPC-BE version across the estate and flag hosts running builds prior to commit 4341cb3.

How to Mitigate CVE-2026-36910

Immediate Actions Required

Update MPC-BE to a build that includes commit 4341cb3 or later.
Restrict opening of MP4 files sourced from untrusted senders until patched builds are deployed.
Communicate the risk to end users and provide guidance to report unexpected media player crashes.

Patch Information

The fix is committed in the upstream MPC-BE repository at commit 4341cb3. Users should install a release built from this commit or newer. Refer to the MPC-BE GitHub Issue #1062 for confirmation of the patched revision and the Bento4 GitHub Issue #873 for related parser context.

Workarounds

Use an alternative, patched media player to open MP4 files from untrusted sources.
Block or quarantine MP4 attachments at the mail gateway pending user validation.
Apply application allow-listing to prevent execution of MPC-BE builds below the fixed commit.

bash

# Verify the installed MPC-BE version on Windows endpoints
Get-ItemProperty "HKLM:\Software\MPC-BE" | Select-Object DisplayVersion, InstallLocation