CVE-2026-2889

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2889", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-20T17:14:28.102Z", "datePublished": "2026-02-21T22:02:11.011Z", "dateUpdated": "2026-02-23T19:29:40.587Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T22:02:11.011Z"}, "title": "CCExtractor mp4.c processmp4 use after free", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "Use After Free"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "CCExtractor", "versions": [{"version": "0.96.0", "status": "affected"}, {"version": "0.96.1", "status": "affected"}, {"version": "0.96.2", "status": "affected"}, {"version": "0.96.3", "status": "affected"}, {"version": "0.96.4", "status": "affected"}, {"version": "0.96.5", "status": "affected"}, {"version": "0.96.6", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-02-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-20T18:20:15.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Oneafter (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347182", "name": "VDB-347182 | CCExtractor mp4.c processmp4 use after free", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347182", "name": "VDB-347182 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755029", "name": "Submit #755029 | CCExtractor ccextractor c65fb08 Memory Corruption", "tags": ["third-party-advisory"]}, {"url": "https://github.com/CCExtractor/ccextractor/issues/2055", "tags": ["issue-tracking"]}, {"url": "https://github.com/CCExtractor/ccextractor/pull/2057", "tags": ["issue-tracking"]}, {"url": "https://github.com/oneafter/0123/blob/main/cc3/repro", "tags": ["exploit"]}, {"url": "https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925", "tags": ["patch"]}, {"url": "https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6", "tags": ["patch"]}, {"url": "https://github.com/CCExtractor/ccextractor/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:29:23.923780Z", "id": "CVE-2026-2889", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:29:40.587Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2889", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:29:23.923780Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:29:34.642Z"}}], "cna": {"tags": ["x_open-source"], "title": "CCExtractor mp4.c processmp4 use after free", "credits": [{"lang": "en", "type": "reporter", "value": "Oneafter (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "n/a", "product": "CCExtractor", "versions": [{"status": "affected", "version": "0.96.0"}, {"status": "affected", "version": "0.96.1"}, {"status": "affected", "version": "0.96.2"}, {"status": "affected", "version": "0.96.3"}, {"status": "affected", "version": "0.96.4"}, {"status": "affected", "version": "0.96.5"}, {"status": "unaffected", "version": "0.96.6"}]}], "timeline": [{"lang": "en", "time": "2026-02-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-20T18:20:15.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347182", "name": "VDB-347182 | CCExtractor mp4.c processmp4 use after free", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347182", "name": "VDB-347182 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755029", "name": "Submit #755029 | CCExtractor ccextractor c65fb08 Memory Corruption", "tags": ["third-party-advisory"]}, {"url": "https://github.com/CCExtractor/ccextractor/issues/2055", "tags": ["issue-tracking"]}, {"url": "https://github.com/CCExtractor/ccextractor/pull/2057", "tags": ["issue-tracking"]}, {"url": "https://github.com/oneafter/0123/blob/main/cc3/repro", "tags": ["exploit"]}, {"url": "https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925", "tags": ["patch"]}, {"url": "https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6", "tags": ["patch"]}, {"url": "https://github.com/CCExtractor/ccextractor/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T22:02:11.011Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2889", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:29:40.587Z", "dateReserved": "2026-02-20T17:14:28.102Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-21T22:02:11.011Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CCExtractor", "vendor": "n/a", "versions": [{"status": "affected", "version": "0.96.0"}, {"status": "affected", "version": "0.96.1"}, {"status": "affected", "version": "0.96.2"}, {"status": "affected", "version": "0.96.3"}, {"status": "affected", "version": "0.96.4"}, {"status": "affected", "version": "0.96.5"}, {"status": "unaffected", "version": "0.96.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en CCExtractor hasta 0.96.5 que afecta a la funci\u00f3n processmp4 en la biblioteca src/lib_ccx/mp4.c. Manipularlo provoca un use after free. El ataque solo es posible con acceso local. El exploit ahora es p\u00fablico y puede ser usado. La actualizaci\u00f3n 0.96.6 es capaz de solventar este problema. El parche se llama fd7271bae238ccb3ae8a71304ea64f0886324925. Deber\u00eda actualizar el componente afectado."}], "id": "CVE-2026-2889", "lastModified": "2026-06-17T10:31:58.650", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 1.7, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2889", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:29:23.923780Z", "version": "2.0.3"}}]}, "published": "2026-02-21T22:15:59.353", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/CCExtractor/ccextractor/"}, {"source": "cna@vuldb.com", "url": "https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925"}, {"source": "cna@vuldb.com", "url": "https://github.com/CCExtractor/ccextractor/issues/2055"}, {"source": "cna@vuldb.com", "url": "https://github.com/CCExtractor/ccextractor/pull/2057"}, {"source": "cna@vuldb.com", "url": "https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6"}, {"source": "cna@vuldb.com", "url": "https://github.com/oneafter/0123/blob/main/cc3/repro"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.347182"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.347182"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.755029"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-416"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.96.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.96.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.96.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.96.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.96.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.96.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.96.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CCExtractor", "source": "cna", "vendor": "n/a"}, "product": "ccextractor", "vendor": "ccextractor"}], "analysis": {"en": {"generated_at": "2026-04-18T11:16:11.541572+00:00", "value": {"mitigation_remediation": ["Upgrade CCExtractor to version 0.96.6 or later to apply the vendor patch", "Limit local execution of CCExtractor to trusted users or restrict privileges to reduce attack surface", "Run CCExtractor within an isolated environment such as a container or sandbox to contain potential memory corruption"], "summary": {"action": "Patch", "impact": "Use After Free in CCExtractor library"}, "threat_synthesis": {"affected_systems": "CCExtractor is the affected vendor and product. Versions up to and including 0.96.5 contain the flaw; version 0.96.6 contains the remediation in commit fd7271bae238ccb3ae8a71304ea64f0886324925. Tools or services that embed or run CCExtractor locally are therefore vulnerable.", "description_and_impact": "CCExtractor\u2019s processmp4 function in mp4.c contains a use\u2011after\u2011free flaw that arises after certain manipulations of MP4 data. When triggered, the vulnerability can cause the program to access freed memory, which may corrupt data, crash the process, or potentially allow an attacker to execute arbitrary code. The weakness is a classic memory safety issue (CWE\u2011119 and CWE\u2011416).", "risk_and_exploitability": "The CVSS score of 4.8 indicates a low severity based on current metrics, and the EPSS score of less than 1% signals a very low probability of exploitation at present. The vulnerability is only exploitable with local access, but the exploit code is publicly available, meaning any user who runs CCExtractor with local privileges could potentially trigger the bug. The issue is not listed in the CISA KEV catalog, but the active public exploit elevates the risk to administrators who must act promptly."}}}}, "created": "2026-02-23T14:29:56.319748+00:00", "updated": "2026-04-18T11:30:44.305218+00:00", "vendors": ["ccextractor", "ccextractor$PRODUCT$ccextractor"]}