QwikSec

Security Database

CVE

CWE

Training

CVE-2026-2889

Published: Feb 21, 2026

Modified: Feb 23, 2026

PUBLISHED

CVSS v3.1

3.3

LOW

Description

A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.

Vendor	Product	Versions
n/a	CCExtractor	affected `0.96.0` affected `0.96.1` affected `0.96.2` affected `0.96.3` affected `0.96.4` +2 more versions

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

References

VDB-347182 | CCExtractor mp4.c processmp4 use after free

vdb-entry

technical-description

VDB-347182 | CTI Indicators (IOB, IOC, IOA)

signature

permissions-required

Submit #755029 | CCExtractor ccextractor c65fb08 Memory Corruption

third-party-advisory

https://github.com/CCExtractor/ccextractor/issues/2055

issue-tracking

https://github.com/CCExtractor/ccextractor/pull/2057

issue-tracking

https://github.com/oneafter/0123/blob/main/cc3/repro

exploit

https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925

patch

https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6

patch

https://github.com/CCExtractor/ccextractor/

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.