CVE-2026-125203 FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder

High 8.5 Published 9 Nov 2026 Updated 10 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125203?

CVE-2026-125203 is a high-severity vulnerability in FFmpeg, published on 9 Nov 2026.

Official description

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing cook_decode_frame() to write decoded samples beyond allocated output planes in any application decoding the file.

Weakness: CWE-787

Which versions are affected by CVE-2026-125203?

How do I fix CVE-2026-125203?

No fix has been published for CVE-2026-125203 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125203 being exploited?

There is no known exploitation of CVE-2026-125203 in the wild and no public exploit code.

Sources

Also known as GHSA-gc9x-4w7v-3282, UBUNTU-CVE-2026-125203.