NULL Pointer Dereference in MPC-BE MP4 Parser

Executive Summary

This vulnerability is a NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3. It occurs when the software processes a specially crafted MP4 file, which causes the program to attempt to access memory through a NULL pointer.

This leads to a crash or Denial of Service (DoS) condition, meaning the application stops functioning properly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing crashes or segmentation faults when processing MP4 files with affected software such as MPC-BE using the Bento4 library.

Specifically, reproducing the issue involves dragging and dropping specially crafted malicious MP4 files into MPC-BE, which triggers crashes during file parsing.

AddressSanitizer or similar memory error detection tools can be used to detect null pointer dereferences or invalid memory accesses when running utilities like mp42aac from Bento4.

No explicit network or system commands are provided in the resources, but monitoring application crashes and using debugging tools to analyze segmentation faults during media file processing can help detect the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is that an attacker can cause the MPC-BE application to crash or become unavailable by providing a maliciously crafted MP4 file.

This Denial of Service (DoS) can disrupt normal use of the software, potentially affecting availability of media playback.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-36912 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding opening or processing untrusted or specially crafted MP4 media files with MPC-BE or any software using the vulnerable Bento4 library.

Applying patches or updates to MPC-BE and Bento4 that address this vulnerability once available is critical.

Until patches are applied, restricting the use of affected media processing utilities and monitoring for crashes or system instability can reduce risk.

Useful 0 Not Useful 0