CVE-2026-36911

Received Received - Intake

Division-by-Zero DoS in MPC-BE Media Player

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: MITRE

Description

A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-01

Generated

2026-07-02

AI Q&A

2026-07-02

EPSS Evaluated

N/A

NVD

CVE-2026-36911

Affected Vendors & Products

Vendor	Product	Version / Range
aleksoid1978	mpc-be	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a division-by-zero error in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE software versions before a specific commit (4341cb3).

An attacker can exploit this by providing a specially crafted MP4 file that triggers the division-by-zero condition.

This causes the software to crash or become unavailable, resulting in a Denial of Service (DoS).

Impact Analysis

Exploitation of this vulnerability can cause the affected software (MPC-BE) to crash or stop functioning properly.

This leads to a Denial of Service (DoS), meaning legitimate users may be unable to use the media player when processing certain MP4 files.

Hi! I’m here to help you understand CVE-2026-36911. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70