CVE-2026-2889 – A use-after-free vulnerability in CCExtractor's... (How to Fix)

Q: What is the severity of CVE-2026-2889?

CVE-2026-2889 has a CVSS score of 3.3 (LOW). A use-after-free vulnerability in CCExtractor's processmp4 function allows local attackers to potentially execute arbitrary code or cause denial of service. This affects users of CCExtractor versions up to 0.96.5 who process MP4 files. The vulnerability requires local access to exploit.

📋 TL;DR

A use-after-free vulnerability in CCExtractor's processmp4 function allows local attackers to potentially execute arbitrary code or cause denial of service. This affects users of CCExtractor versions up to 0.96.5 who process MP4 files. The vulnerability requires local access to exploit.

💻 Affected Systems

Products:

CCExtractor

Versions: All versions up to and including 0.96.5

Operating Systems: All platforms running CCExtractor

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability triggers when processing MP4 files via the affected processmp4 function

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation leading to full system compromise or arbitrary code execution with user privileges

🟠

Likely Case

Application crash or denial of service when processing malicious MP4 files

🟢

If Mitigated

No impact if proper access controls prevent local users from executing CCExtractor with malicious files

🌐 Internet-Facing: LOW - Requires local access, not remotely exploitable

🏢 Internal Only: MEDIUM - Local users could exploit if they can run CCExtractor with crafted MP4 files

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires local access and ability to feed malicious MP4 files to CCExtractor

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.96.6

Vendor Advisory: https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6

Restart Required: No

Instructions:

1. Download CCExtractor 0.96.6 from GitHub releases. 2. Replace existing installation with new version. 3. Verify installation with version check.

🔧 Temporary Workarounds

Restrict local user access

linux

Limit which users can execute CCExtractor to reduce attack surface

chmod 750 /usr/local/bin/ccextractor
setfacl -m u:trusteduser:rx /usr/local/bin/ccextractor

Monitor MP4 file processing

all

Implement file integrity monitoring for MP4 files processed by CCExtractor

🧯 If You Can't Patch

Restrict CCExtractor execution to trusted users only
Implement application whitelisting to prevent unauthorized CCExtractor execution

🔍 How to Verify

Check if Vulnerable:

Check CCExtractor version: ccextractor --version

Check Version:

ccextractor --version

Verify Fix Applied:

Verify version is 0.96.6 or higher: ccextractor --version | grep -q '0.96.[6-9]\|0.9[7-9]\|[1-9][0-9]'

📡 Detection & Monitoring

Log Indicators:

CCExtractor crash logs
Segmentation fault errors in system logs when processing MP4 files

Network Indicators:

None - local vulnerability only

SIEM Query:

process_name:"ccextractor" AND (event_type:"crash" OR error_message:"segmentation fault")

📊 Metadata

CVE ID: CVE-2026-2889

CVSS v3 Score: 3.3 (LOW)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-119

Published: February 21, 2026

Last Updated: February 23, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-2889, you might also want to check these: