CVE-2026-125182

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...

CVE-2026-125182 FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...

CVE-2026-125182

Versions of FFmpeg through 9.0.2 are vulnerable to an out-of-bounds read in the Cook decoder's joint_decode() function. The root cause is that cook_decode_init() fails to validate js_subband_start against subbands . An attacker can leverage a crafted RealMedia file with malicious extradata to tri...

EUVD-2026-120271

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...

CVE-2026-125182: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because…

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...