CVE-2026-2889: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-2889 is a use-after-free vulnerability in CCExtractor, an open-source subtitle extraction tool, affecting versions up to and including 0.96.5. The flaw resides in the processmp4 function within src/lib_ccx/mp4.c, where a NULL or dangling pointer to a freed memory region can be passed to the mprint logging function, triggering a segmentation fault. The vulnerability was reported on January 23, 2026, patched on January 24, 2026, and publicly disclosed on February 21, 2026. It carries a CVSS v3.1 base score of 3.3 (Low), requiring local access and low privileges (Feedly, GitHub Issue).

The root cause is classified as CWE-416 (Use After Free) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In processmp4 (line 902 of src/lib_ccx/mp4.c), the function calls mprint — a wrapper around vfprintf — with a file parameter that may be NULL or point to already-freed memory (indicated by the ASAN-detected poison pattern 0xBEBEBEBEBEBEBEBE). This causes internal_strlen to dereference the invalid pointer when processing a %s format specifier, resulting in a SIGSEGV. Exploitation requires an attacker to supply a specially crafted MP4 file and execute CCExtractor locally; no network access is required (GitHub Issue, GitHub Commit).

Successful exploitation causes an application crash (denial of service), resulting in a low availability impact with no confidentiality or integrity impact, consistent with the CVSS scoring. Since CCExtractor is a command-line tool typically run locally or in automated media processing pipelines, the blast radius is limited to the process and session in which it runs. There is no evidence of lateral movement potential or sensitive data exposure from this specific vulnerability (Feedly).

A proof-of-concept reproducer file was publicly disclosed alongside the bug report on January 23, 2026, making exploitation trivial for anyone with local access to a vulnerable CCExtractor installation. The EPSS score is 0.012% (0.000120), indicating very low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution or in-the-wild exploitation has been reported (GitHub Issue, Feedly).

1. Obtain a vulnerable version: Confirm the target system is running CCExtractor version 0.96.5 or earlier (e.g., ccextractor --version).
2. Craft or obtain a malicious MP4 file: Prepare a specially crafted MP4 file designed to trigger the NULL/dangling pointer condition in processmp4. The original reporter used a fuzzing-generated reproducer file.
3. Execute CCExtractor locally: Run ./ccextractor <malicious_file.mp4> on the target system with a local user account (low privileges required).
4. Trigger the crash: The processmp4 function passes the freed or NULL file pointer to mprint, which calls vfprintf with a %s format specifier, causing internal_strlen to dereference the invalid address (0xBEBEBEBEBEBEBEBE) and crash the process with a SIGSEGV (GitHub Issue).

• Process: CCExtractor process terminating unexpectedly with a segmentation fault (exit code 139/SIGSEGV) when processing MP4 files.
• Logs: ASAN output containing AddressSanitizer: SEGV on unknown address with register rdi = 0xbebebebebebebebe or similar poison-pattern addresses; stack trace referencing processmp4 in src/lib_ccx/mp4.c:902 and internal_strlen.
• File System: Presence of unexpected or malformed MP4 files submitted for processing, particularly those that consistently crash the tool (GitHub Issue).

Upgrade CCExtractor to version 0.96.6, released on February 20, 2026, which includes the fix in commit fd7271bae238ccb3ae8a71304ea64f0886324925. The patch adds a NULL check for the file parameter in processmp4 before it is passed to mprint, returning an error code of -1 if NULL is detected. No configuration-based workaround is available; upgrading is the only remediation (GitHub Release, GitHub Commit).