CVE-2026-125182: FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start

Q: What conditions are required to exploit this issue?

An attacker must induce FFmpeg to decode a crafted RealMedia file. The crafted file's extradata must cause an invalid js_subband_start value that exceeds the available subbands.

Q: Who is exposed in practice?

Applications or services that use affected FFmpeg versions to decode untrusted RealMedia content are exposed. The attack requires local access and user interaction, according to the supplied CVSS vector.

Q: What is the likely impact of successful exploitation?

The out-of-bounds read can leak pointers and decoder state into decoded audio. This information may help an attacker defeat ASLR, but the provided data does not indicate integrity or availability impact.

Q: How can I tell whether a file may be attempting to trigger the flaw?

The relevant indicator is RealMedia Cook decoder extradata that sets js_subband_start beyond the configured number of subbands. The issue occurs during Cook decoder initialization and subsequent joint decoding.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode() function because cookdecodeinit() does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and decoder state into decoded audio to help defeat ASLR.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker must induce FFmpeg to decode a crafted RealMedia file. The crafted file's extradata must cause an invalid js_subband_start value that exceeds the available subbands.

Who is exposed in practice?

Applications or services that use affected FFmpeg versions to decode untrusted RealMedia content are exposed. The attack requires local access and user interaction, according to the supplied CVSS vector.

What is the likely impact of successful exploitation?

The out-of-bounds read can leak pointers and decoder state into decoded audio. This information may help an attacker defeat ASLR, but the provided data does not indicate integrity or availability impact.

How can I tell whether a file may be attempting to trigger the flaw?

The relevant indicator is RealMedia Cook decoder extradata that sets js_subband_start beyond the configured number of subbands. The issue occurs during Cook decoder initialization and subsequent joint decoding.

CVE-2026-125182: FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start

Affected Software

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

Who is exposed in practice?

What is the likely impact of successful exploitation?

How can I tell whether a file may be attempting to trigger the flaw?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

Who is exposed in practice?

What is the likely impact of successful exploitation?

How can I tell whether a file may be attempting to trigger the flaw?