CVE-2026-125203 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's Cook multichannel decoder does not check that subpacket channel masks are disjoint, so a crafted RealMedia Cook stream makes it write decoded samples past allocated buffers. An attacker who gets a victim to decode such a file can corrupt memory, which may lead to code execution in the application doing the decoding.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application that decodes RealMedia Cook audio with FFmpeg's libavcodec is exposed, most of all services that process media files from users or the internet. Systems that never decode RealMedia or use FFmpeg only on trusted local files are lower risk and can be skipped after confirming the version.
Not affected if fixed-version, no-realmedia-decoding
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; affected builds are before 8.1.3 on the 8.x line and before 9.0.2 on the 9.x line.8.1.3 for the 8.x line9.0.2 for the 9.x lineFFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing cook_decode_frame() to write decoded samples beyond allocated output planes in any application decoding the file.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.