CVE-2026-36911: MPC-BE Media Player DoS Vulnerability

CVE-2026-36911 Overview

CVE-2026-36911 is a division-by-zero vulnerability [CWE-369] in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE, a Windows media player. An attacker who convinces a user to open a crafted MP4 file can trigger the flaw and cause the media player process to crash, resulting in Denial of Service (DoS). The issue affects MPC-BE builds prior to commit 4341cb3, which addresses the divisor validation gap.

Critical Impact
Local user interaction with a malicious MP4 file crashes the MPC-BE media player, disrupting availability of the application on the affected host.

Affected Products

Aleksoid1978 MPC-BE versions before commit 4341cb3
Windows systems running vulnerable MPC-BE builds
Any workflow that opens untrusted MP4 files with MPC-BE

Discovery Timeline

2026-07-01 - CVE-2026-36911 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-36911

Vulnerability Analysis

The vulnerability resides in CStreamSwitcherOutputPin::DecideBufferSize, a DirectShow output pin routine that negotiates buffer allocation for stream switching. During buffer size calculation, the function performs a division using a value derived from the input media stream. When a crafted MP4 supplies a zero value where a non-zero divisor is expected, the arithmetic operation raises an unhandled hardware exception. This terminates the MPC-BE process and produces a Denial of Service condition. The flaw does not corrupt memory or leak data, and it does not permit code execution.

Root Cause

The root cause is missing input validation on a divisor operand inside DecideBufferSize. The function trusts stream metadata parsed from the MP4 container without confirming that fields used in division are non-zero. Because the container format is attacker-controlled, any malformed or hostile file can propagate the zero value into the arithmetic path. The upstream fix in commit 4341cb3 adds the necessary bounds check before the division executes.

Attack Vector

Exploitation requires local access and user interaction. The attacker delivers a crafted MP4 file through phishing, drive-by download, removable media, or file share, then convinces the victim to open it with MPC-BE. No authentication or elevated privileges are required. The impact is limited to availability of the media player process on the target host. See the GitHub Issue Discussion for reproducer context.

No verified public proof-of-concept code is available. The vulnerability manifests when the MP4 parser propagates a zero-valued stream parameter into the buffer size division inside CStreamSwitcherOutputPin::DecideBufferSize.

Detection Methods for CVE-2026-36911

Indicators of Compromise

Unexpected crashes of mpc-be.exe or mpc-be64.exe immediately after opening an MP4 file
Windows Error Reporting (WER) entries referencing integer division-by-zero exceptions (0xC0000094) in MPC-BE
Application event log entries showing MPC-BE faulting module tied to stream switcher components

Detection Strategies

Monitor endpoint telemetry for repeated mpc-be.exe process terminations correlated with MP4 file access events.
Inspect WER and minidump artifacts for STATUS_INTEGER_DIVIDE_BY_ZERO originating in MPC-BE modules.
Flag delivery of MP4 attachments from untrusted senders when MPC-BE is the default handler on user endpoints.

Monitoring Recommendations

Track installed MPC-BE build hashes across the fleet and alert on versions predating commit 4341cb3.
Correlate media player crash events with recent file downloads or email attachments to identify targeted delivery.
Retain crash dumps for forensic review to distinguish this DoS from memory corruption issues in the same codec pipeline.

How to Mitigate CVE-2026-36911

Immediate Actions Required

Update MPC-BE to a build that includes commit 4341cb3 or later.
Restrict opening MP4 files from untrusted sources until the update is deployed.
Communicate to end users that unsolicited media files should not be opened in MPC-BE.

Patch Information

The fix is applied in the MPC-BE source tree at commit 4341cb3, which introduces validation before the divisor is used inside CStreamSwitcherOutputPin::DecideBufferSize. Users should install the next official MPC-BE release incorporating this commit. Refer to the GitHub Issue Discussion for tracking status.

Workarounds

Use an alternate, patched media player to open MP4 files sourced from external parties.
Configure file associations so MP4 files do not open in MPC-BE by default on high-risk endpoints.
Block or quarantine MP4 attachments at the email gateway when originating from unverified senders.

bash

# Verify installed MPC-BE version on Windows endpoints
powershell -Command "Get-ItemProperty 'HKLM:\SOFTWARE\MPC-BE' | Select-Object Version, ExePath"