NULL Pointer Dereference in MPC-BE MP4 Parser

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: MITRE

Description

A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-01

Generated

2026-07-02

AI Q&A

2026-07-02

EPSS Evaluated

N/A

NVD

CVE-2026-36912

Affected Vendors & Products

Vendor	Product	Version / Range
aleksoid1978	mpc-be	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3. It occurs when the software processes a specially crafted MP4 file, which causes the program to attempt to access memory through a NULL pointer.

This leads to a crash or Denial of Service (DoS) condition, meaning the application stops functioning properly.

Impact Analysis

The primary impact of this vulnerability is that an attacker can cause the MPC-BE application to crash or become unavailable by providing a maliciously crafted MP4 file.

This Denial of Service (DoS) can disrupt normal use of the software, potentially affecting availability of media playback.

Hi! I’m here to help you understand CVE-2026-36912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70