CVE-2026-125182

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...