CVE-2026-125203

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...

CVE-2026-125182

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...

EUVD-2026-120292

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...

CVE-2026-125203 FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...

CVE-2026-125203 FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...

CVE-2026-125203

The FFmpeg multimedia framework is vulnerable to a heap buffer overflow in the Cook multichannel decoder (located in libavcodec/cook.c). The issue occurs because the software fails to verify that subpacket channel masks are disjoint. An attacker can provide a crafted RealMedia Cook stream with ov...

CVE-2026-125182 FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...

CVE-2026-125182

Versions of FFmpeg through 9.0.2 are vulnerable to an out-of-bounds read in the Cook decoder's joint_decode() function. The root cause is that cook_decode_init() fails to validate js_subband_start against subbands . An attacker can leverage a crafted RealMedia file with malicious extradata to tri...

PT-2026-141010

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint decode function because cook decode init does not check js subband start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode buffer 0, leaking pointers...

PT-2026-141031

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing co...

CVE-2026-125203: FFmpeg: FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder…

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...

CVE-2026-125182: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because…

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...

CLEANSTART-2024-XJ25142 GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability

Security vulnerability affects the gst-plugins-ugly package. GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability...

CLEANSTART-2025-VZ56385 FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory

Security vulnerability affects the ffmpeg package. FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory...

Astra Linux – Vulnerability in gst-plugins-ugly1.0

GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may...

Astra Linux – Vulnerability in gst-plugins-ugly1.0

GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Ugly Plugins vulnerabilities (USN-8896-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8896-1 advisory. Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certai...

USN-8896-1 gst-plugins-ugly1.0 vulnerabilities

Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubunt...

USN-8896-1: GStreamer Ugly Plugins vulnerabilities

Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubunt...

CLEANSTART-2024-LM99875 FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory

Security vulnerability affects the ffmpeg4 package. FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory...