Executive brief
MPC-BE is a popular open-source media player for Windows. A vulnerability was found where opening a specially crafted MP4 video file can cause the application to crash or stop responding. This issue primarily affects the reliability of the software and could be used to disrupt a user's ability to play media files.
Technical details
A NULL pointer dereference exists in the AP4_TkhdAtom::GetTrackId() function within the Bento4 library component used by Aleksoid1978 MPC-BE. The vulnerability is triggered when the application attempts to parse a malformed MP4 file containing specific atom structures. An attacker can exploit this by providing a crafted file to a user, which, when opened, causes the media player to crash (Denial of Service). The issue was addressed in commit 4341cb3.
Affected products
- Aleksoid1978 MPC-BE before commit 4341cb3
Timeline
- 2026-07-01: advisory: NVD publication date
- 2026-07-01: disclosed