CVE-2026-125182

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint decode() function because cook decode init() does not check js subband start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode buffer 0, leaking pointers and decoder state into decoded audio to help defeat ASLR.