CVE-2026-125182 PUBLISHED

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR.

• Yuyao Jiang finder
• Joshua Rogers (AISLE Research) reporter
• Michael Niedermayer remediation developer

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763
• Patch Commit
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cook.c#L854
• https://github.com/FFmpeg/FFmpeg
• VulnCheck Advisory: FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start

• Out-of-bounds Read CWE