CVE-2026-36912: MPC-BE Media Player DoS Vulnerability

CVE-2026-36912 Overview

CVE-2026-36912 is a NULL pointer dereference vulnerability in Aleksoid1978 MPC-BE, a media player based on Media Player Classic. The flaw resides in the AP4_AtomSampleTable::GetSample() function, which is inherited from the Bento4 MP4 parsing library. A crafted MP4 file causes the function to dereference a NULL pointer, crashing the media player process. The vulnerability affects MPC-BE builds prior to commit 4341cb3.

Critical Impact
Attackers can trigger a Denial of Service (DoS) condition by delivering a malformed MP4 file to a target user, crashing the media player without requiring authentication or user privileges beyond opening the file.

Affected Products

Aleksoid1978 MPC-BE before commit 4341cb3
Bento4 library (AP4_AtomSampleTable component) used by MPC-BE
MP4 container parsing pipeline in affected MPC-BE builds

Discovery Timeline

2026-07-01 - CVE-2026-36912 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-36912

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] within the AP4_AtomSampleTable::GetSample() function. This routine is responsible for retrieving sample metadata from atoms in an MP4 file structure. When a crafted MP4 file omits or malforms atoms required to populate internal sample table pointers, GetSample() proceeds to dereference a pointer that was never initialized. The resulting access violation terminates the MPC-BE process.

The attack vector is network-adjacent in the sense that the malicious file can be delivered through any channel that MPC-BE opens: HTTP streaming, SMB shares, downloaded attachments, or removable media. The impact is limited to availability, with no data confidentiality or integrity consequences.

Root Cause

The root cause is missing validation of pointer fields inside sample table atoms before dereference. AP4_AtomSampleTable::GetSample() assumes that structures referenced by the parsed MP4 metadata are present and non-NULL. A crafted MP4 that omits required child atoms or supplies inconsistent sample counts leaves those pointers uninitialized, and the function dereferences them without a guard clause.

Attack Vector

An attacker crafts an MP4 file that violates the expected atom hierarchy in the sample table (stbl) structure. The victim opens the file in MPC-BE, either directly or through a playlist. During demuxing, AP4_AtomSampleTable::GetSample() is invoked and crashes the player. No authentication or elevated privileges are required. The vulnerability details are tracked in the MPC-BE GitHub issue and the upstream Bento4 issue report.

Detection Methods for CVE-2026-36912

Indicators of Compromise

Unexpected termination or crash dumps of mpc-be.exe or mpc-be64.exe following the opening of an MP4 file
Windows Error Reporting (WER) entries referencing access violations inside MPC-BE modules
MP4 files with malformed or truncated sample table (stbl) atoms delivered via email, downloads, or shared storage

Detection Strategies

Monitor for repeated crashes of media player processes correlated with recently opened MP4 files
Inspect MP4 files at the gateway for structural anomalies in moov, trak, and stbl atoms using validated MP4 parsers
Correlate file open events with subsequent process exit codes indicating access violations (0xC0000005)

Monitoring Recommendations

Enable and centrally collect Windows Error Reporting and application crash telemetry for endpoints running MPC-BE
Track the version and build commit of MPC-BE across managed endpoints to identify hosts still exposed to builds prior to commit 4341cb3
Log inbound MP4 files from untrusted sources and retain samples for offline structural analysis

How to Mitigate CVE-2026-36912

Immediate Actions Required

Update MPC-BE to a build that includes commit 4341cb3 or later
Restrict opening MP4 files from untrusted sources until the update is deployed
Inventory endpoints running MPC-BE and prioritize remediation on systems that process externally sourced media

Patch Information

The upstream fix was committed to the MPC-BE repository as commit 4341cb3. Users must upgrade to a released build that incorporates this commit. Refer to the MPC-BE GitHub issue for the patch discussion and to the upstream Bento4 issue report for the library-level fix context.

Workarounds

Do not open MP4 files received from untrusted sources in vulnerable MPC-BE builds
Use an alternative media player with independent MP4 parsing until MPC-BE is updated
Apply gateway or endpoint controls that block or quarantine MP4 files failing structural validation

bash

# Verify the installed MPC-BE build version on Windows endpoints
powershell -Command "Get-Item 'C:\Program Files\MPC-BE x64\mpc-be64.exe' | Select-Object -ExpandProperty VersionInfo"