CVE-2026-125203

FFmpeg versions before 8.1.3 and 9.x before 9.0.2 are vulnerable to a heap buffer overflow in the Cook multichannel decoder (located in libavcodec/cook.c). The root cause is a failure to verify that subpacket channel masks are disjoint . An attacker can exploit this by providing a crafted RealMed...

EUVD-2026-120292

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...