{"id":"CVE-2026-125182","kind":"vulnerability","aliases":["CVE-2026-125182"],"related":[],"title":"FFmpeg: crafted RealMedia file leaks memory through Cook audio decoder","description":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR.","summary":"FFmpeg through 9.0.2 fails to validate a Cook decoder field, so a crafted RealMedia file can read past a buffer. The read leaks pointers and decoder state into decoded audio, which can help an attacker defeat address randomization.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package","realmedia"],"not_affected_if":["no-realmedia-decoding","trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; versions through `9.0.2` are in the affected range.\n- Find where FFmpeg is used to decode RealMedia (`.rm`, `.ra`) files from untrusted sources, such as upload or transcoding pipelines.","fix":"- FFmpeg: a patch is linked from the advisory sources; the fixed version is unknown from the sources.","status":"open","published_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:32:21+00:00","updated_at":"2026-11-09T19:32:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:21Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: a patch is linked from the advisory sources; the fixed version is unknown from the sources.","reach":"unknown","title":"FFmpeg: crafted RealMedia file leaks memory through Cook audio decoder","impact":"low","summary":"FFmpeg through 9.0.2 fails to validate a Cook decoder field, so a crafted RealMedia file can read past a buffer. The read leaks pointers and decoder state into decoded audio, which can help an attacker defeat address randomization.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","realmedia"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"memory contents leak through decoded audio, aiding further exploitation","analyst_note":"Confirm the fixed FFmpeg version and the patch commit from the linked GitHub patch and the VulnCheck advisory.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; versions through `9.0.2` are in the affected range.\n- Find where FFmpeg is used to decode RealMedia (`.rm`, `.ra`) files from untrusted sources, such as upload or transcoding pipelines.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-realmedia-decoding","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg and decode RealMedia files supplied by outside users, such as media conversion services or upload pipelines. Local use on trusted files is much lower risk. unknown whether the sources name a specific fixed release.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4627,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125182':13A,16A '-2026':12A,15A '0':105C '9.0.2':25B,63C 'address':59B 'aslr':117C 'attack':57B,91C 'audio':9A,52B,113C 'bound':69C 'buffer':42B,104C 'caus':100C 'check':85C 'contain':64C 'cook':8A,30B,74C,80C 'craft':2A,35B,95C 'cve':11A,14A 'decod':10A,31B,48B,51B,75C,77C,81C,103C,109C,112C 'defeat':58B,116C 'extradata':99C 'fail':26B 'ffmpeg':1A,17B,23B,61C 'field':32B 'file':4A,37B,97C 'function':78C 'help':55B,115C 'init':82C 'joint':76C 'js':86C 'leak':5A,45B,106C 'media':19B 'media-process':18B 'memori':6A 'out-of-bound':66C 'packag':21B 'past':40B,102C 'pointer':46B,107C 'process':20B 'random':60B 'read':39B,44B,70C,101C 'realmedia':3A,22B,36B,96C 'start':88C 'state':49B,110C 'subband':87C,90C 'suppli':93C 'valid':28B 'vulner':71C 'whose':98C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg and decode RealMedia files supplied by outside users, such as media conversion services or upload pipelines. Local use on trusted files is much lower risk. unknown whether the sources name a specific fixed release.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","package","realmedia"],"campaign_type":null,"search_a":"'-125182':13A,16A '-2026':12A,15A 'audio':9A 'cook':8A 'craft':2A 'cve':11A,14A 'decod':10A 'ffmpeg':1A 'file':4A 'leak':5A 'memori':6A 'realmedia':3A","search_b":"'9.0.2':25B 'address':59B 'attack':57B 'audio':52B 'buffer':42B 'cook':30B 'craft':35B 'decod':31B,48B,51B 'defeat':58B 'fail':26B 'ffmpeg':17B,23B 'field':32B 'file':37B 'help':55B 'leak':45B 'media':19B 'media-process':18B 'packag':21B 'past':40B 'pointer':46B 'process':20B 'random':60B 'read':39B,44B 'realmedia':22B,36B 'state':49B 'valid':28B","search_c":"'0':105C '9.0.2':63C 'aslr':117C 'attack':91C 'audio':113C 'bound':69C 'buffer':104C 'caus':100C 'check':85C 'contain':64C 'cook':74C,80C 'craft':95C 'decod':75C,77C,81C,103C,109C,112C 'defeat':116C 'extradata':99C 'ffmpeg':61C 'file':97C 'function':78C 'help':115C 'init':82C 'joint':76C 'js':86C 'leak':106C 'out-of-bound':66C 'past':102C 'pointer':107C 'read':70C,101C 'realmedia':96C 'start':88C 'state':110C 'subband':87C,90C 'suppli':93C 'vulner':71C 'whose':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125182","severity":null,"published_at":"2026-11-09T19:16:53+00:00","modified_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109254,"url":"https://github.com/FFmpeg/FFmpeg/commit/7145d13201c9f9c5253f40295714faa4f4ada1a0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109255,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-cook-decoder-js-subband-start","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}