# CVE-2026-125203

Heap overflow in FFmpeg Cook decoder enabling memory corruption/RCE from crafted RealMedia streams

- Page: https://www.vulneraibility.com/cve/CVE-2026-125203
- CVSS: 8.5
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-787
- Published: 2026-11-09

## Affected versions

- FFmpeg: affected < 8.1.3; >= 9.0 and < 9.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Heap buffer overflow when decoding crafted RealMedia Cook streams; allows memory corruption, crashes, or remote code execution in apps using vulnerable FFmpeg.

## Action

Immediate action required

## Recommendation

Upgrade FFmpeg to 8.1.3 or 9.0.2+; block or sanitize untrusted RealMedia files.

## References

- [other] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24485
- [patch] https://github.com/FFmpeg/FFmpeg/commit/3e09f5e24eb277a6d011745ff03e602f61c5c171
- [other] https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/cook.c#L1294
- [other] https://github.com/FFmpeg/FFmpeg
- [advisory] https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-buffer-overflow-in-cook-multichannel-decoder

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.