Low severity · published Feb 21, 2026
CVE-2026-2889
CCExtractor mp4.c processmp4 use after free
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CCExtractor ·
0.96.0; 0.96.1; 0.96.2; 0.96.3; 0.96.4; 0.96.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2889
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2889
github.com
https://github.com/CCExtractor/ccextractor/
github.com
https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925
github.com
https://github.com/CCExtractor/ccextractor/issues/2055
github.com
https://github.com/CCExtractor/ccextractor/pull/2057
github.com
https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6
github.com
https://github.com/oneafter/0123/blob/main/cc3/repro
More from CCExtractor
3.3
CVE-2026-2245
CCExtractor MPEG-TS File ts_tables.c parse_PMT out-of-bounds