CVE-2026-2245

CCExtractor MPEG-TS File ts_tables.c parse_PMT out-of-bounds

4.8 Medium

A vulnerability was identified in CCExtractor up to 183. This affects the function parse_PAT/parse_PMT in the library src/lib_ccx/ts_tables.c of the component MPEG-TS File Parser. Such manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The name of the patch is fd7271bae238ccb3ae8a71304ea64f0886324925. It is best practice to apply a patch to resolve this issue.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.15%Up 0.1 points since Feb 10, 2026

What each source reports

CVE List Score used 4.8

CCExtractor MPEG-TS File ts_tables.c parse_PMT out-of-bounds

Record: CVE-2026-2245
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0: 3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0: 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness: CWE-125, CWE-119
Updated: 2026-11-02

EUVDEUVD-2026-6740 4.8

Record: EUVD-2026-6740
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w24p-5m2c-jvfh 1.9

A vulnerability was identified in CCExtractor up to 183. This affects the function parse_PAT...

Record: GHSA-w24p-5m2c-jvfh
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-119
Updated: 2026-11-02

NVD 1.9

Record: CVE-2026-2245
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0: 1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-119, CWE-125
Updated: 2026-11-02

OSV 1.9

CCExtractor MPEG-TS File ts_tables.c parse_PMT out-of-bounds

Record: CVE-2026-2245
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness: CWE-119, CWE-125
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-2245 1.9

Record: DEBIAN-CVE-2026-2245
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-2245 1.9

Record: UBUNTU-CVE-2026-2245
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`ccextractor` Debian:11	All versions, plus listed versions 0.88+ds1-10.93+ds1-10.93+ds2-10.93+ds2-20.94+ds1-10.94+ds1-20.94+ds1-3	None known
`ccextractor` Ubuntu:20.04:LTS	All versions, plus listed versions 0.87+ds1-1	None known
`ccextractor` Ubuntu:22.04:LTS	All versions, plus listed versions 0.88+ds1-10.93+ds2-10.93+ds2-1ubuntu10.93+ds2-2	None known
`ccextractor` Ubuntu:24.04:LTS	All versions, plus listed versions 0.94+ds1-30.94+ds1-3build20.94+ds1-3build3	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-2245 is a medium vulnerability (CVSS 4.8) in ccextractor, published February 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. No source names a fixed version.

References

Show 9 moreShow less