CVE-2026-2889

LOW

CCExtractor <=0.96.5 - Use After Free

Title source: llm

Description

A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.

References (9)

[Various Sources] https://github.com/CCExtractor/ccextractor/

[Various Sources] https://github.com/oneafter/0123/blob/main/cc3/repro

View Writeup ZIP pw:eip

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.347182

[Permissions Required, VDB Entry] https://vuldb.com/?id.347182

[Permissions Required, VDB Entry] https://vuldb.com/?submit.755029

[Patch] https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925

[Issue Tracking] https://github.com/CCExtractor/ccextractor/issues/2055

[Issue Tracking] https://github.com/CCExtractor/ccextractor/pull/2057

[Release Notes] https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6

Scores

CVSS v3 3.3

EPSS 0.0001

EPSS Percentile 2.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Classification

CWE

CWE-119 CWE-416

Status draft

Timeline

Published Feb 21, 2026

Tracked Since Feb 22, 2026