p PatchFirst

CVE-2026-2889

CVE-2026-2889 · CCExtractor mp4.c processmp4 use after free

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.

CVSS 4.8 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ccextractor

    Versions
    • 0.96.0: Affected
    • 0.96.1: Affected
    • 0.96.2: Affected
    • 0.96.3: Affected
    • 0.96.4: Affected
    • 0.96.5: Affected
    • 0.96.6: Not affected

    Update to 0.96.6

  • ccextractor Debian:11

    Versions
    • 0.88+ds1-1
    • 0.93+ds1-1
    • 0.93+ds2-1
    • 0.93+ds2-2
    • 0.94+ds1-1
    • 0.94+ds1-2
    • 0.94+ds1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ccextractor Ubuntu:20.04:LTS

    Versions
    • 0.87+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ccextractor Ubuntu:22.04:LTS

    Versions
    • 0.88+ds1-1
    • 0.93+ds2-1
    • 0.93+ds2-1ubuntu1
    • 0.93+ds2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ccextractor Ubuntu:24.04:LTS

    Versions
    • 0.94+ds1-3
    • 0.94+ds1-3build2
    • 0.94+ds1-3build3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →