PT-2026-21397 · Unknown · Ccextractor

Oneafter · Published 2026-02-21 · Updated 2026-02-22 · CVE-2026-2889

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions CCExtractor versions up to 0.96.5

Description A use-after-free issue exists in the processmp4 function within the src/lib ccx/mp4.c library of CCExtractor. This issue is exploitable with local access. The exploit is publicly available.

Recommendations Upgrade to version 0.96.6 or later to address this issue.

Exploit

Fix

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

CVE-2026-2889

Affected Products

Ccextractor

References · 20

• 🔥 https://github.com/oneafter/0123/blob/main/cc3/repro · Exploit
• https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6 · Patch
• https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925 · Patch
• https://ubuntu.com/security/CVE-2026-2889 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2889 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2889 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-2889 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2889 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2889 · Security Note
• https://github.com/CCExtractor/ccextractor/issues/2055 · Note
• https://github.com/CCExtractor/ccextractor/pull/2057 · Note
• https://t.me/CVEtracker/45398 · Telegram Post
• https://vuldb.com/?id.347182 · Note
• https://github.com/CCExtractor/ccextractor · Note