Out-of-Bounds Read in FFmpeg Cook Decoder

Executive Summary

This is an out-of-bounds read vulnerability in FFmpeg through version 9.0.2. The issue occurs in the Cook decoder's joint_decode() function. The problem is that cook_decode_init() does not properly validate the js_subband_start value against the number of subbands. This allows attackers to craft a RealMedia file with malicious extradata that causes reads beyond the intended decode_buffer_0, potentially leaking memory contents and decoder state.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive memory, bypassing ASLR protections. This might allow them to leak information or manipulate audio output. The impact is limited to systems using vulnerable FFmpeg versions to decode RealMedia files with Cook audio codec.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to version 9.0.3 or later to address the out-of-bounds read vulnerability in the Cook decoder. Avoid processing untrusted RealMedia files until patched.

Useful 0 Not Useful 0