A NULL pointer dereference occurs in the AP4_AtomSampleTable::GetSample() function of the MPC‑BE media player. The missing null check triggers a crash when parsing a malformed MP4 file, leading to a denial of service for the user who opens or plays the file. The weakness is classified as CWE‑476 and does not compromise data confidentiality or integrity; it only interrupts playback.

The issue affects all releases of MPC‑BE that were built before the commit 4341cb3. Users running those builds who encounter or intentionally process maliciously crafted MP4 files are vulnerable. No other vendors or product families are known to be impacted.

The EPSS score is below 1 % and the CVSS score is 7.5, indicating a high severity but low likelihood of exploitation. Based on the description, the likely attack vector is local file handling: attackers need to supply a crafted MP4 file that does not require privileged escalation or data exposure. Because the vulnerability can only cause service interruption, the overall risk is moderate and it is not listed in CISA’s KEV catalog.