CVE-2026-125182

Description

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763 ↗
• https://github.com/FFmpeg/FFmpeg/commit/7145d13201c9f9c5253f40295714faa4f4ada1a0 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cook.c#L854 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-cook-decoder-js-subband-start ↗