A null pointer dereference in the AP4_TkhdAtom::GetTrackId function of the MPC‑BE media craft a malicious MP4 file that triggers a crash. The failure to guard against a null pointer indicates improper input validation, classified as CWE‑476. While the crash does not leak or modify data, it results in an interruption of media playback and can repeatedly disrupt services that rely on the player, leading to a loss of availability.

The affected software is the MPC‑BE media player. Builds that include the unpatched source code before commit 4341cb3 are susceptible; any version derived from those sources without the commit is impacted. No other vendors or products are listed in the advisory, and no specific version range is provided beyond the pre‑commit state.

The CVSS score of 6.2 denotes medium severity for a Denial‑of‑Service attack, and the EPSS score is less 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not catalogued in CISA's KEV. Attackers can trigger the crash by delivering a crafted MP4 file, likely through local file playback or remote download; no elevated privileges are required. Given the limited exploit likelihood and absence of data compromise, the overall risk profile is moderate, but repeated crashes can still hamper user experience and downstream services.