CCExtractor’s processmp4 function in mp4.c contains a use‑after‑free flaw that arises after certain manipulations of MP4 data. When triggered, the vulnerability can cause the program to access freed memory, which may corrupt data, crash the process, or potentially allow an attacker to execute arbitrary code. The weakness is a classic memory safety issue (CWE‑119 and CWE‑416).

CCExtractor is the affected vendor and product. Versions up to and including 0.96.5 contain the flaw; version 0.96.6 contains the remediation in commit fd7271bae238ccb3ae8a71304ea64f0886324925. Tools or services that embed or run CCExtractor locally are therefore vulnerable.

The CVSS score of 4.8 indicates a low severity based on current metrics, and the EPSS score of less than 1% signals a very low probability of exploitation at present. The vulnerability is only exploitable with local access, but the exploit code is publicly available, meaning any user who runs CCExtractor with local privileges could potentially trigger the bug. The issue is not listed in the CISA KEV catalog, but the active public exploit elevates the risk to administrators who must act promptly.