CVE-2026-2245: CCExtractor Use-After-Free Vulnerability

CVE-2026-2245 Overview

CVE-2026-2245 is an out-of-bounds read vulnerability discovered in CCExtractor, an open-source tool for extracting closed captions from video files. The vulnerability affects the parse_PAT and parse_PMT functions within the MPEG-TS File Parser component, specifically in src/lib_ccx/ts_tables.c. When processing maliciously crafted MPEG-TS files, the parser fails to properly validate buffer boundaries, allowing attackers to read memory outside the intended buffer region.

Critical Impact

This vulnerability enables local attackers to trigger out-of-bounds memory reads through specially crafted MPEG-TS files, potentially causing application crashes or exposing sensitive memory contents.

Affected Products

• CCExtractor versions up to and including version 183
• Systems running vulnerable CCExtractor installations for media processing
• Automated video processing pipelines utilizing CCExtractor

Discovery Timeline

• 2026-02-09 - CVE-2026-2245 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-2245

Vulnerability Analysis

This out-of-bounds read vulnerability resides in CCExtractor's MPEG-TS (Transport Stream) parsing functionality. The issue stems from improper memory buffer operations (CWE-119) in the parse_PAT and parse_PMT functions responsible for processing Program Association Table and Program Map Table structures within MPEG-TS streams.

When CCExtractor processes an MPEG-TS file, it parses elementary stream information descriptors. The vulnerable code fails to validate that the ES_info_length field combined with the current buffer offset does not exceed the total buffer length before accessing memory. This allows an attacker to craft a malicious MPEG-TS file with manipulated descriptor lengths that cause the parser to read beyond allocated buffer boundaries.

The attack requires local access to execute, as the attacker must provide a malicious file to the CCExtractor application. A proof-of-concept is publicly available, increasing the practical risk of exploitation.

Root Cause

The root cause is insufficient boundary validation in the descriptor parsing loop within the parse_PMT function. The code iterates through elementary stream descriptors using the ES_info_length field from the MPEG-TS structure without first verifying that this length, when combined with the current position, remains within the allocated buffer. Additionally, the code does not verify that sufficient bytes remain for reading the mandatory descriptor tag and length fields before attempting to access them.

Attack Vector

The vulnerability requires local access to exploit. An attacker must craft a malicious MPEG-TS file containing manipulated ES_info_length values that exceed actual buffer bounds. When a victim processes this file using CCExtractor (either manually or through an automated processing pipeline), the parser reads beyond the allocated buffer, potentially causing:

1. Application crashes due to accessing invalid memory
2. Information disclosure if sensitive data resides in adjacent memory regions
3. Denial of service in automated video processing systems

The official security patch adds boundary validation checks as shown below:

		{
			// if this any generally used video stream tyoe get clashed with ATSC/SCTE standard
			// then this code can go in some atsc flag
+			// Validate ES_info_length against buffer bounds to prevent heap overflow
+			if (i + 5 + ES_info_length > len)
+				break;
+
			unsigned char *es_info = buf + i + 5;
-			for (desc_len = 0; (buf + i + 5 + ES_info_length) > es_info; es_info += desc_len)
+			unsigned char *es_info_end = buf + i + 5 + ES_info_length;
+			for (desc_len = 0; es_info_end > es_info; es_info += desc_len)
			{
+				// Need at least 2 bytes for descriptor_tag and desc_len
+				if (es_info + 2 > es_info_end)
+					break;
+
				enum ccx_mpeg_descriptor descriptor_tag = (enum ccx_mpeg_descriptor)(*es_info++);
				int nb_service;
				int is_608;

Source: GitHub CCExtractor Commit

Detection Methods for CVE-2026-2245

Indicators of Compromise

• Unexpected CCExtractor crashes or segmentation faults when processing video files
• Abnormal memory access patterns in CCExtractor process monitoring
• Presence of unusual or untrusted MPEG-TS files in processing directories

Detection Strategies

• Monitor CCExtractor application logs for crash events or memory-related errors
• Implement file integrity monitoring on video processing input directories
• Deploy memory access monitoring tools on systems running CCExtractor
• Review system logs for repeated CCExtractor process terminations

Monitoring Recommendations

• Enable application crash reporting and centralize logs from media processing systems
• Monitor for unusual file submissions to video processing pipelines
• Implement runtime application self-protection (RASP) on systems processing untrusted media files
• Set up alerts for abnormal CCExtractor resource consumption patterns

How to Mitigate CVE-2026-2245

Immediate Actions Required

• Update CCExtractor to a version containing patch commit fd7271bae238ccb3ae8a71304ea64f0886324925 or later
• Audit systems for CCExtractor installations and prioritize updates on internet-facing or automated processing systems
• Restrict CCExtractor input to trusted file sources until patched
• Implement input validation for MPEG-TS files before processing

Patch Information

The CCExtractor development team has released a security fix addressing this vulnerability. The patch (commit fd7271bae238ccb3ae8a71304ea64f0886324925) adds proper boundary validation to prevent out-of-bounds memory access during MPEG-TS parsing. Users should update to the latest version from the GitHub CCExtractor Repository.

Additional details are available in GitHub Issue #2053 and Pull Request #2057.

Workarounds

• Run CCExtractor in a sandboxed environment or container to limit potential impact
• Process only MPEG-TS files from verified and trusted sources
• Implement file validation checks before passing files to CCExtractor
• Deploy CCExtractor with reduced system privileges to minimize exposure

# Configuration example
# Run CCExtractor in a restricted container environment
docker run --rm -v /trusted/input:/input:ro -v /output:/output \
  --security-opt no-new-privileges --cap-drop ALL \
  ccextractor/ccextractor:latest /input/video.ts -o /output/subtitles.srt