CVE-2026-2245: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-2245 is an out-of-bounds read vulnerability in CCExtractor, a subtitle extraction tool, affecting versions up to and including 0.183 (commit prior to fd7271b). The flaw resides in the parse_PAT and parse_PMT functions within src/lib_ccx/ts_tables.c, part of the MPEG-TS file parser component. A local, low-privileged attacker can trigger the vulnerability by supplying a malformed MPEG-TS file, leading to a heap-buffer-overflow read. It was disclosed on February 9, 2026, and carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (Feedly, CCExtractor Issue #2053).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In parse_PAT, the function reads section_number and last_section_number from payload_start[6] and payload_start[7] without first verifying that payload_length is at least 8 bytes, allowing reads 22 bytes past the end of a 184-byte heap-allocated TS payload buffer. In parse_PMT, the ES_info_length field is not validated against the actual buffer bounds before iterating over descriptor entries, and the inner loop does not check for a minimum of 2 bytes before reading descriptor_tag and desc_len, enabling similar out-of-bounds reads. Exploitation requires a locally accessible malformed MPEG-TS file and a low-privileged user account; a public proof-of-concept reproducer file is available (CCExtractor Issue #2053, CCExtractor Commit fd7271b, PoC Reproducer).

Successful exploitation results in a heap-buffer-overflow read, which can crash the CCExtractor process (denial of service) and may expose adjacent heap memory contents. The primary impact is availability (application crash/abort), with a limited potential for information disclosure from heap memory. There is no evidence of integrity impact or remote code execution capability based on current analysis, and the vulnerability's local-only attack vector significantly limits its scope (Feedly, CCExtractor Issue #2053).

A public proof-of-concept reproducer file is available in the researcher's GitHub repository, and the CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is 0.012% (0.000120), indicating a very low probability of exploitation in the wild. The attack is constrained to local access with low privileges, further reducing real-world risk (Feedly, PoC Reproducer).

1. Prepare environment: Obtain a local account on a system running a vulnerable version of CCExtractor (≤ 0.183, prior to commit fd7271b).
2. Obtain or craft malformed MPEG-TS file: Use the publicly available reproducer file from the researcher's repository (https://github.com/oneafter/0123/blob/main/cc1/repro), or craft a custom MPEG-TS file where the PAT section specifies a section_length that extends beyond the 184-byte TS payload buffer, or where the PMT ES_info_length field exceeds the actual buffer bounds.
3. Execute CCExtractor with the malformed file: Run ./ccextractor repro (or the equivalent binary path) with the crafted file as input.
4. Trigger out-of-bounds read: The parse_PAT function reads payload_start[6]/[7] without checking payload_length >= 8, or parse_PMT iterates descriptors without validating ES_info_length, causing a heap-buffer-overflow read 22+ bytes past the allocated buffer.
5. Observe crash or memory disclosure: The application aborts (detectable via ASAN report or segfault), achieving denial of service; adjacent heap memory may be read in non-hardened builds (CCExtractor Issue #2053, PoC Reproducer).

• Process: CCExtractor process terminating unexpectedly or with an abort signal when processing MPEG-TS files; ASAN output referencing heap-buffer-overflow in parse_PAT at ts_tables.c:624 or parse_PMT.
• Logs: System logs (e.g., /var/log/syslog) showing CCExtractor process crashes (SIGABRT, SIGSEGV) when processing specific .ts files; application-level error output containing AddressSanitizer: heap-buffer-overflow.
• File System: Presence of unusual or malformed .ts files in directories processed by CCExtractor, particularly files with anomalous PAT/PMT section lengths; core dump files generated by CCExtractor crashes.
• Network: Not applicable — exploitation is local only (CCExtractor Issue #2053).

Apply the fix introduced in commit fd7271bae238ccb3ae8a71304ea64f0886324925, which adds bounds checks for payload_length >= 8 in parse_PAT and validates ES_info_length and minimum descriptor size in parse_PMT. Users should update CCExtractor to a version that includes this commit (merged January 24, 2026, into the master branch via PR #2057). No configuration-based workaround is available; upgrading or rebuilding from patched source is the recommended remediation (CCExtractor Commit fd7271b, CCExtractor PR #2057).