FFmpeg versions prior to 8.1.3 and the 9.x series before 9.0.2 contain a heap buffer overflow in the Cook multichannel decoder. The flaw arises because the software does not ensure that subpacket channel masks are disjoint, allowing an attacker to supply a crafted RealMedia Cook stream with overlapping masks. When cook_decode_frame processes such input it writes decoded samples beyond the bounds of allocated output planes, corrupting heap memory. Depending on the memory corruption context, this could lead to application crashes, privilege escalation, or remote code execution if the application runs with elevated privileges.

The vulnerability affects the FFmpeg project, specifically all builds of the FFmpeg binary prior to release 8.1.3 and any 9.x versions before 9.0.2. Users running these legacy FFmpeg releases on any platform that decodes files via the Cook decoder are exposed to the flaw.

The CVSS score of 8.5 classifies the issue as high severity. Although EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, the failure to validate channel masks provides an exploitable heap overflow. The likely attack vector is the delivery of a malicious Cook stream file to an application; the attacker must be able to provide the file to the decoder, which can occur through local media files or network streams sent to vulnerable software.