A null pointer dereference in the AP4_TkhdAtom::GetTrackId function of the MPC‑BE media player allows an attacker to cause a crash by providing a crafted MP4 file. The bug results in an unhandled null pointer, leading to a program crash that stops playback. Because no data is leaked or modified, the flaw is a pure availability weakness, classified as CWE‑476.

The CVE applies to the MPC‑BE media player. Any build that contains the unpatched source code prior to commit 4341cb3 is affected; there is no specific version range provided beyond this pre‑commit state. No other vendors or products are listed as affected in the advisory.

The reported CVSS score is 6.2, indicating a medium severity denial‑of‑service vulnerability. The EPSS score is below 1 %, suggesting a very low but non‑zero likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. An attacker can trigger the crash by delivering a malicious MP4 file, typically through local playback or remote download. Privilege escalation is not required, and the crash is confined to the media player process, but repeated crashes can degrade user experience and disrupt dependent services.