CVE Alert: CVE-2026-125203 – FFmpeg

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing cook_decode_frame() to write decoded samples beyond allocated output planes in any application decoding the file.

**Risk verdict:** High risk for systems that decode untrusted media; exploitation urgency cannot be confirmed because KEV, SSVC, PoC and EPSS indicators were not provided.

**Why this matters:** A successful attack could compromise the decoding process’s confidentiality, integrity and availability, potentially enabling data theft, tampering or service disruption. The practical risk is greatest where user-supplied or externally sourced media is processed automatically or at scale.

**Most likely attack path:** An attacker delivers a crafted media file for a user or service to open or process. The attack needs no prior privileges and has low complexity, but requires user interaction; the stated scope indicates impact is confined to the vulnerable application’s security authority, with no indicated direct lateral movement.

**Who is most exposed:** Media conversion, streaming, editing and content-ingestion services are common exposure points, as are desktop applications and embedded systems that bundle decoding libraries. Prioritise internet-facing or automated pipelines handling files from untrusted sources.

Identify processes decoding Cook audio within RealMedia files, especially in conversion or ingestion jobs.

Alert on decoder crashes, abnormal worker restarts or memory-corruption symptoms during media processing.

Review upload, email and job logs for suspicious RealMedia files immediately preceding failures.

Mitigation and prioritisation

Upgrade to a fixed release, or apply the upstream fix through your supported package channel.

Until patched, block or quarantine untrusted RealMedia files and disable Cook decoding where operationally feasible.

Restrict media-processing workers’ file, network and system access; use isolation and resource limits.

Test representative workflows in staging, then deploy promptly; identify bundled copies, not just standalone installations.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.