Is there a public PoC exploit available for EUVD-2026-26922?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26922. Prioritise patching immediately. EPSS: 0.0%.

tsMuxer EUVD-2026-26922

Q: What is the CVSS score of EUVD-2026-26922?

EUVD-2026-26922 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7739 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-04 VulDB

Denial Of Service Tsmuxer

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:17 vuln.today

Public exploit code

Analysis Generated

May 04, 2026 - 07:31 vuln.today

CVSS changed

May 04, 2026 - 07:22 NVD

3.3 (LOW) 1.9 (LOW)

EUVD ID Assigned

May 04, 2026 - 07:00 euvd

EUVD-2026-26922

Analysis Generated

May 04, 2026 - 07:00 vuln.today

CVE Published

May 04, 2026 - 06:15 nvd

LOW 1.9

DescriptionCVE.org

A weakness has been identified in justdan96 tsMuxer up to 2.7.0. This vulnerability affects the function HevcVpsUnit::setFPS of the file /AFLplusplus/tsMuxer_prev/tsMuxer/hevc.cpp. This manipulation of the argument track_id causes denial of service. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Denial of service in tsMuxer up to version 2.7.0 via improper input validation in the HevcVpsUnit::setFPS function allows local authenticated attackers to crash the application by manipulating the track_id argument. The vulnerability affects only unsupported product versions and carries a very low CVSS score (1.9), though publicly available exploit code exists.

Technical ContextAI

tsMuxer is a video multiplexing utility that processes HEVC (H.265) video streams. The vulnerability resides in the HevcVpsUnit::setFPS function within hevc.cpp, which handles frame rate configuration for HEVC video parameter sets. The flaw is categorized under CWE-404 (Improper Resource Validation), indicating that the function fails to properly validate the track_id parameter before using it in a way that triggers a denial of service condition. The attack vector is local (AV:L), requiring an authenticated user with low privileges (PR:L) to supply crafted input that causes the application to malfunction or crash.

RemediationAI

The most effective remediation is to upgrade tsMuxer to a version newer than 2.7.0 if available from the justdan96 GitHub repository (https://github.com/justdan96/tsMuxer/). Since the vulnerability description indicates affected versions are no longer supported by the maintainer, users should verify whether newer unsupported-maintenance releases or community forks provide fixes. As a compensating control, restrict local access to tsMuxer by limiting user accounts with execution privileges on systems running the application, though this may impact legitimate workflow automation. Additionally, monitor tsMuxer process execution logs for unexpected crashes or error conditions that might indicate exploitation attempts. Given the low CVSS score and local-only attack vector, organizations not running tsMuxer as a service or in shared-access environments face negligible practical risk.