CVE-2026-2889CWE-119CWE-416

CCExtractor mp4.c processmp4 use after free

Medium · published February 21, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00195 · 8.7th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-416 · Use After Free
Published
2026-02-21T22:02Z
EPSS history
Timeline
  • 21 FEB 22:02Z
    CCExtractor mp4.c processmp4 use after free
    cvelistv5