UBUNTU-CVE-2026-125182: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode() function because cookdecodeinit() does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and decoder state into decoded audio to help defeat ASLR.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems that use the affected FFmpeg Cook decoder to process RealMedia files are exposed, particularly where untrusted media files may be opened or decoded.

What does an attacker need to exploit it?

An attacker needs to provide a crafted RealMedia file with malicious extradata. Exploitation also requires a user or application to decode that file; the supplied vector indicates local attack conditions and user interaction.

What could an attacker obtain?

The out-of-bounds read can leak pointers and decoder state through decoded audio. This information may help an attacker defeat ASLR.

How can I determine whether a file is attempting to trigger the issue?

The vulnerable condition involves RealMedia content whose extradata sets js_subband_start outside the valid subbands range. The provided data does not identify a file signature, log event, or runtime indicator beyond that decoder condition.

UBUNTU-CVE-2026-125182: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker obtain?

How can I determine whether a file is attempting to trigger the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker obtain?

How can I determine whether a file is attempting to trigger the issue?