MediaMonkey releases a crash when a user opens a specially crafted MP3 file containing an excessively long URL string. The application fails during processing of this string, causing the program to terminate unexpectedly. The resulting loss of service interrupts the user’s ability to manage music files, and the vulnerability falls under reference CWE-226, a denial‑of‑service weakness caused by improper handling of user‑supplied input.

Only the specific build of MediaMonkey 4.1.23.1881 for Windows, distributed by VentisMedia, is affected. No other versions or platforms are listed as vulnerable. The issue manifests when the File > Open URL dialog is invoked with a malicious file; therefore installing or running other MediaMonkey editions or non‑Windows systems is not documented as impacted.

The CVSS score of 6.9 reflects moderate severity, and the EPSS score of less than 1 % indicates that exploit activity is currently rare. The vulnerability is not cataloged in CISA’s KEV list. Attackers must have local access to the machine or persuade a user to open the malicious MP3, which means the vector is inferred as local or social engineering; no remote exploitation is documented. Consequently, the risk is that a victim’s MediaMonkey instance may be unexpectedly terminated, impacting only the affected workstation.