Twenty One Zero-Days in FFmpeg

https://depthfirst.com/research/21-zero-days-in-ffmpeg

by redbell • 1 month ago

289 188 1 month ago

How does the browser use it ?unless they mean there’s a zero day in libavcodec

fpoling2• 1 month ago

Browsers run it in a sandbox process together with allocator hardening. Most of the bugs then are just crashed of the sandbox

Another option is WASM or WASM-style sandboxes if using another process is undesirable.

johnnythunder• 1 month ago

One chained sandbox escape away from compromise.

nemothekid• 1 month ago

The reach of this bug is what makes it serious. Any deployment that points FFmpeg at an attacker-influenced RTSP URL is exposed: media ingest pipelines fetching user-supplied stream URLs, surveillance and CCTV systems pulling RTSP feeds, and transcoding services processing remote AV1-over-RTP sources

Wow this is actually pretty serious - I'm even surprised its being published. There are several services where I can imagine this is exploitable today.

akerl_3• 1 month ago

Some people might suggest it’s crucial to publish if you’re aware of a serious vulnerability, so that people using the software in a vulnerable way can take steps to mitigate the risk.

skupig2• 1 month ago

You would also need some sort of ASLR leak to make this exploitable

woodruffw2• 1 month ago

Speaking from firsthand experience: codec and other media processing libraries are some of the easiest software to find address leaks in.

(There are a number of reasons for this, not least being that C makes it very easy to ship partially initialized memory over the wire.)

TiredOfLife• 1 month ago

ffmpeg has stated many many times that they don't care about bug or security reports

hulitu• 1 month ago

Wow this is actually pretty serious

Don't tranform your ffmpeg instance into a web browser.

jacobgold• 1 month ago

I've been using ffmpeg for a very long time, both personally and for services I've built. Fabrice Bellard is a genius, and the developers who have taken it so far have made the world measurably richer.

But I can't think of a program more worthy of sandboxing when run with untrusted input than ffmpeg. It's a huge amount of C dealing with the most complicated video and audio codecs, which is notoriously impossible to get completely right.

But it's not actually that big of a problem. I run ffmpeg inside a VM or gVisor, and the end result is usually a video file that I'm perfectly willing to play in my browser, where it gets decoded in yet another sandbox because this shit is hard.

Gehinnn• 1 month ago

What do you mean "video file that I'm perfectly willing to play in my browser". Isn't it safe to assume that no video file can escape the browser decoding sandbox?

thaumasiotes• 1 month ago

Isn't it safe to assume that no video file can escape the browser decoding sandbox?

Why would that be safe to assume? If that were a reasonable assumption, you could just as well assume that it's safe to run ffmpeg.

kjs3• 1 month ago

Isn't it safe to assume that no video file can escape the browser decoding sandbox?

It's 'safe to assume' it's not. It's emphatically not safe to assume any mitigation is perfect.

preg_match2• 1 month ago

No, browsers have had many sandbox escape exploits related to decoding.

cyberax• 1 month ago

But then you also often need hardware accelerators for encoding, so you need to use C again.

Terr_• 1 month ago

I glumly predict that copyright-holding companies wanting DRM, "trusted platforms", regulatory capture, etc. will drive some of the damage here.

Secure sandboxing tends to mean opportunities to make unrestricted copies.

wavemode2• 1 month ago

At this point the corrupted free pointer is called, and control of the instruction pointer is ours.

Very serious, though in practice it doesn't sound like this bug achieves arbitrary RCE on its own (especially in the presence of ASLR). You would need there to be some writable and executable page of memory lying around.

skupig2• 1 month ago

The article glosses over this, but it looks like the next variable in the struct is conveniently the first parameter to the function, so you can run arbitrary code with system() or whatever. But, yeah, you would need some other exploit to defeat ASLR.

ttoinou3• 1 month ago

Is the future of defense-against-foreign-agents-on-my-codebase to subtly hide prompt injections into one’s codebase that would defeat agents to find security bugs ?

If the attackers of ffmpeg need to be using such those authors’ services to find RCE in popular tools to attack, what the ffmpeg team needs to defeat attackers is to reduce efficiency of such tools depthfirst

Davidzheng• 1 month ago

No...

fizzynut• 1 month ago

I find difficult to know how serious the issue is, if it is even an issue.

LLM constantly confidently giving me this same sounding script with a "the root cause" and how it "is simple" while being completely incorrect.

josephg• 1 month ago

Its 21 issues. And they've been human validated, as far as I can tell.

lostglass4• 1 month ago

Most of them involve very weird and unlikely scenarios and bad security practices or access to the ffmpeg binaries and being allowed to run arbitrary commands at an elevated permission.

In and of itself there's not a massive issue from what I can see, they're entry vectors that can lead to worse situations.

That's not to say they're not serious but if a Russian hacking group is using one of them it's in conjunction with other exploits or security flaws. Which is common in practice when it comes to decoding.

zerobees• 1 month ago

Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago:

https://security.googleblog.com/2014/01/ffmpeg-and-thousand-...

So, while it's a demo of the capabilities of LLMs, this should not be at all surprising. Ffmpeg is absolutely not something you should be running outside of a sandbox if you're touching any untrusted or user-supplied content. I know that people do, and these people are taking unreasonable risks.

loeg2• 1 month ago

They're also extremely hostile to security researchers who report these issues.

insanitybit• 1 month ago

https://x.com/ffmpeg/status/2039115531744334180?s=46&t=qCSkw...

Security is the punch line for ffmpeg.

grahamjperrin2• 1 month ago

… hostile to security researchers who report these issues.

Do you have an example?

duped2• 1 month ago

One dude running an X account is not indicative of a community to be honest.

That said, that dude has a point. "Researchers" chasing clout with their names attached to CVEs is kind of ridiculous. Half these CVEs are missing bounds checks that can be fixed with a patch in as much effort as writing up the blog post announcing that there was a missing bounds check.

lkt• 1 month ago

The guy running the twitter account is incompetent but the actual devs are a lot saner I think.

I agree it reflects poorly on them though

dspillett6• 1 month ago

I wouldn't call "nice find, care to help us fix that?" extremely hostile. It can be frustrating for open source projects that far more people want a pat on the back for the identification of a problem (be it security, performance, documentation, or anything else) than there are people who have the time and inclination to help resolve the issue (or ability and inclination to fund the project so it can more easily find help if needed). The use of LLM based tools apparently making that pat on the back easier to attain is going to exacerbate that problem for a while at least.

gerdesj• 1 month ago

ffmpeg is also rather popular and delivers a lot of functionality. Its unlikely that you don't have it installed.

Yes, there are security issues but quite a few are not ffmpeg itself related - the input is pretty shabby or at least not exactly easy to deal with!

Obviously, they could do with some assistance and I'm sure you and I will both dive in with equal zeal.

RetroTechie2• 1 month ago

Hmm.. "shabby input" that makes software xyz fail is a problem in software xyz itself!

"Validate your inputs" is a common rule. Fuzzing is a thing. Both for good reasons (including security).

naturalmovement4• 1 month ago

[flagged]

bawolff3• 1 month ago

nearly inexhaustible supply of LLM slop daily,

Actual well written vulnerability reports are not the same as slop.

AI slop is a real problem and annoying. Just because it exists does not mean every vulnerability report is AI slop.

Ffmpeg devs are free not to care, but then they cant complain when they start to get a bad reputation.

LeoPanthera• 1 month ago

You should rethink this kind of casual racism.

nerdsniper2• 1 month ago

Is GStreamer a more secure alternative or does it just get a bit less attention than ffmpeg?

ranger_danger• 1 month ago

In my experience it's mainly run by very grumpy and opinionated Europeans who take pride in having bugs old enough to drink.

WD-42• 1 month ago

From what I understand gstreamer is more about building complex pipelines and plugins, ffmpeg is better at playing some obscure 20 year old video format extremely efficiently so you can watch it compiled for a potato.

Different cases really I think both are good.

wmf• 1 month ago

Doesn't GStreamer mostly use ffmpeg plugins?

hugmynutus• 1 month ago

GStreamer is just a different front end to ffmpeg.

ffmpeg's core functionality (encode, decode, streams, pipes, channels) are all implemented in `libav` which gstreamer links against.

derf_• 1 month ago

Any multimedia project trying to support a large number of formats, whose usage in the wild differs by orders of magnitude, is going to have code of varying quality (although quality is not strictly correlated with usage: age and complexity are also big factors, among others). GStreamer puts plugins into different categories (-good, -bad, etc.) based on things like the maturity of the code, which helps you judge what risks you are taking. With FFmpeg it is harder to know which formats are more likely to have issues. Of course GStreamer can use FFmpeg, in which case you will also have all of FFmpeg's problems.

In both cases you are best off restricting things to what you actually use.

samiv• 1 month ago

Gstreamer is a multimedia framework where the user creates media DAGs by placing video/audio/multimedia elements such as demuxers, decoders etc in a pipeline. The framework then takes care of running the media pipeline and handles the data buffering etc.

Within the framework there are multitudes of plugin packages that contain said elements and many of them are built on top of ffmpeg.

oinoom• 1 month ago

Funny, John Carmack was just admiring the creator of ffmpeg the other day for being a better programmer. https://x.com/id_aa_carmack/status/2064095424420487226?s=46

tptacek4• 1 month ago

One thing has nothing to do with the other.

wavemode2• 1 month ago

Security vulnerabilities are less about programming ability and more about rigor.

mjg59• 1 month ago

The majority of code in ffmpeg today isn't written by Fabrice, but also there's multiple axes that people view programming ability on. Some people can write software that will do things you couldn't imagine given the constraints. Some people can write software that is resilient against all malformed input. Sometimes these people are the same people, but frequently they're not.

cubefox3• 1 month ago

Ffmpeg is absolutely not something you should be running outside of a sandbox if you're touching any untrusted or user-supplied content.

You would change your opinion quickly if your browser, apps and TV suddenly stopped supporting videos due to relying on FFmpeg.

defrost4• 1 month ago

What prevents running a data stream in, transcoded data out sandbox with no access to unlimited resources, system files, system stacks, etc.

It's okay for a sandbox to fall over due to bad inputs and poor memory security if it can just be restarted and move onto other streams.

bitwize• 1 month ago

Time to RIIR, then?

anonymousiam• 1 month ago

I haven't seen that acronym before, but my guess is that it's "Re-Implement In Rust", right?

endofreach• 1 month ago

Of course. Everybody knows to rather use the obvious alternative to ffmpeg!

dspillett6• 1 month ago

the obvious alternative to ffmpeg

IIRC that is currently sandboxed ffmpeg.

Until the people going on about making an equivalent in pure rust being automatically much safer, stop talking about it and actually get on with making it, of course!

teravor• 1 month ago

while sandboxing ffmpeg directly isn't difficult, unfortunately with something like MPV/VLC that uses ffmpeg it's more challenging. until recently (virtio gpu native context) it wasn't even possible to sandbox a video player without losing all hardware acceleration. at least not from the outside, they could always try to sequester ffmpeg and seccomp it to hell like chromium.

BoingBoomTschak• 1 month ago

Sandboxing not only OS access but also hardware access feels almost impossible to be honest. At least not via user-friendly exec based stuff like bwrap.

Personally, I still try to contain them a bit: https://git.sr.ht/~q3cpma/ezbwrap/tree/master/item/profiles

simjnd2• 1 month ago

FFMPEG has consistently expressed their frustration with the fact that there is a large number of people willing and eager to publish vulnerabilities found in the project, but a comparatively minuscule number of people willing to work on patches to fix them.

codedokode5• 1 month ago

If there are so many vulnerabilities, should not they change approach to development, for example, use memory-safe languages, static analysis, do not use dubious "hacks" that break it?

LegionMammal978• 1 month ago

On the other hand, there's been an endless parade of recent posts from other FOSS maintainers saying "we don't want your drive-by PRs": it's not hard to see people getting dissuaded from the whole dance of determining whether a project is receptive at all, then whether it has a reasonable number of hoops for outsiders to jump through.

Now, personally, when I file a bug report for a FOSS project I like to suggest an underlying cause and fix if I can figure it out, but I more rarely just submit a PR outright.

j1elo• 1 month ago

Well this is nothing but an obvious expectation given the technical level required for doing good quality contributions, no?

I felt this is kinda like there being a large number of people willing to send spam email, but a comparatively minuscule number of people willing to work on ML filters to block it.

imjonse• 1 month ago

The obvious question is, how many of those were the sort that writing in a memory-safe language would make impossible?

They should prompt one of the more adventurous LLMs to find security bugs and with some luck it will deviate from the prompt and rewrite ffmpeg in Rust.

lionkor• 1 month ago

Rewriting ffmpeg in Rust will not solve it. The parts that are memory unsafe in ffmpeg, and similar projects, are not unsafe because C or C++ is inherently unsafe. Instead, it's the CODE that is unsafe. Translating the code (data structures, logic, etc) to Rust does not fix bugs in the code. That code will be littered with "unsafe" code, and of course, it will no longer be maintainable.

jstanley• 1 month ago

Some of the ffmpeg developers were on Lex Fridman's podcast recently, and the topic of security came up.

They were talking about how there was a vulnerability in an extremely niche codec that is only used for one video game from the 90s or something, and were saying that the person who reported the vulnerability was acting like it was a big deal but it's really not because this codec is hardly ever used.

I was left wondering whether they were oblivious to the fact that an attacker who can supply a video file to you is free to use whatever video codec they want? It wouldn't matter if the developers thought the codec was never used at all; if it is still available then an attacker can use it.

Or was I just missing something? Is there a good reason why vulnerabilities in this codec are not a big deal after all?

defrost4• 1 month ago

Big pipeline fat data users of ffmpeg can and do build their own executables that only include the top N codecs, that eliminates minor bug in obscure never used format problems pretty thoroughly.

m4rtink• 1 month ago

Is it really available in practice ? Eg. do major distros even compile ffmpeg with these obscure codecs or you need to recompile it yourself to get it ?

franga2000• 1 month ago

The user is not free to use whatever codec they want. Many niche codecs can't be put into the usual containers, so if you only accept QuickTime/MP4 and AVI, sometimes even just by limiting the file extension, those codecs can't be used.

If your service works by taking whatever file the user gives you and shoving it into unsandboxed ffmpeg, you've already fucked up. It would be nice if you could do that, but that's not a guarantee ffmpeg has ever provided, nor would it make sense for them to spend their limited resources on it.

twobitshifter• 1 month ago

I’m this video you will also learn that much of it is coded in assembly! The developers are prioritizing performance to the extreme, which has its benefits, but I would expect assembly to open up the code to a whole world of vulnerabilities.

hahn-kev• 1 month ago

I use it in WASM on the client and call it a day. It works for our use case, but obviously not most.

mr_toad2• 1 month ago

The difficulty in exploiting ffmpeg is getting anyone to use it on your input. Sure, you might pwn a few people, but is it worth the effort?

preg_match2• 1 month ago

FFmpeg is extremely complex software, with an extreme (and necessary) focus on performance, that exists in an extremely complex domain.

It’s not just FFmpeg. Apple has had more vulnerabilities in image and video decoders than I can count. That stuff is just very hard, and FFmpeg is doing more than anyone else.

nulltype• 1 month ago

For the implemented formats, wuffs is safer and also often faster: https://github.com/google/wuffs

bayouborne• 1 month ago

What about VLC's own built-in versions of decoding libraries (I think, from the FFmpeg project)? Is there a scenario here where we may have to deal with malicious MP4 files?

jeffbee• 1 month ago

All media containers are potentially hostile. Any offset, extent, or reference has to be considered hostile user-provided input.

omoikane• 1 month ago

Is there a timeline for each of these bugs? I wonder if these bugs had been reported to ffmpeg yet.

da_chicken4• 1 month ago

That's not what "zero-day" means.

nerdsniper2• 1 month ago

It seems to have lost its meaning after getting popularized following Stuxnet coverage.

da_chicken4• 1 month ago

No, I think it was since Code Red.

I understand why it's poorly understood. It's a snappy term, and people assume it means "bad" and nothing else because that's all you can get from the context. However, since most people also don't know the difference between a vulnerability and an exploit, they won't understand the definition of a zero-day when they read it.

But I'm still going to complain if a security vulnerability research company is using the term incorrectly in their own press copy. It makes them look amateurish.

journal• 1 month ago

Explain what it means along with your statement. Maybe I have the wrong definition too.

perlgeek• 1 month ago

(not op)

If a security bug is exploited in the wild, it's an n-day if it's been first exploited n days after the publication of the bug, and a zero-day if it's been exploited before or on the day of the publication.

When a bug is not yet exploited in the wild, it's just a discovery of a bug, not a zero-day.

da_chicken4• 1 month ago

I did so in the other reply thread of the comment you replied to.

[Z]ero-day specifically compares when the white hats (vendors, system owners) and the black hats learn about the existence of a vulnerability. If white hats learn that a vulnerability exists by being subject to an in-the-wild black hat exploit of it, then it's a true zero-day.

And, again, you need to be aware that the vulnerability is the flaw or defect in the software or system (e.g., buffer overrun), and the exploit is the specific methodology that takes advantage of it (e.g., worm, malicious web request from a botnet, etc.).

Some people differentiate between a zero day vulnerability and a zero day exploit. I don't really find that is common anymore, and essentially everyone using it means zero-day exploit.

lschueller• 1 month ago

Inflated use of the term zero-day, while none of the described vulnerabilities is actually a zero-day. But it sounds and clicks good.. thank you for the PoC.

tom_• 1 month ago

A victim only has to run ffmpeg -i rtsp://attacker/stream, the most ordinary command imaginable

What about "ls"?

throwaway20373• 1 month ago

I had to read your comment a couple of times to understand it. I assume you are saying that "/bin/ls" is the "most ordinary command imaginable"? I think your original quote is saying most ordinary when running ffmpeg, which has a famously complex command line interface.

kodt• 1 month ago

Infinity - 21 is still infinity

0xbadcafebee• 1 month ago

Even if this isn't as big a deal as this [advertisement for a security company] seems, it is a reminder that every application you release does have a security hole somewhere, and a script kiddie can now find it 5 minutes after release for $2 in credit. If you're not red-teaming your code before release, hackers are doing it after.

appleappleapple• 1 month ago

Help me understand: depthfirst seems to be bigging up their “security agent” here, but is it not just prompt engineering + writing skill files? What goes into producing a “security agent” beyond this? Feels like they’re really gussying up a process that is ultimately just LLM usage

guessmyname• 1 month ago

I think the industry is optimizing for the wrong thing. Generating thousands of AI-written bug reports is easy, at least with Mythos (preview 1) or GPT-5.5. Getting bugs fixed is the hard part.

A few months ago I started working on a system that finds critical security issues and opens PRs instead of just filing reports. The acceptance rate is sitting at roughly 94% so far. Most of the failures were due to project-specific kill switches or other internal mechanisms that weren’t documented, not because the vulnerability itself was misidentified.

Developers generally seem to prefer this approach. A bug report creates work. A good PR removes work. That sounds obvious, but a lot of security products still stop at the report and call it a day.

rcbdev3• 1 month ago

I think I'm missing something here. Apple software has no open source code, how are you suggesting fixes?

tkocmathla• 1 month ago

What?

https://github.com/apple

Rygian• 1 month ago

I think the industry is optimizing for the wrong thing.

Indeed: The industry optimizes for speed, time to market, and features, and applies the ostrich model to everything that doesn't bring short-time revenue (security considerations, accessibility, vendor lock-in, interoperability, …)

This has been going on for as long as the industry exists, and now we start to have the proper tools to assess the damage and understand the brittleness of it all.

deafpolygon• 1 month ago

I just had an unsettling thought… those with access to Mythos/Fable finding these flaws — how many might be holding back and keeping some of these exploits in their back pocket?

codedokode5• 1 month ago

DFVULN-123 (Integer Overflow): In the RTP LATM depacketizer (rtpdec_latm.c), latm_parse_packet() performs a signed 32-bit addition that overflows and bypasses its bounds check

Again there is another vulnerability caused by unchecked addition, and still modern languages like Rust or Go do not raise exception on overflow, and modern CPU architectures like RISC-V provide no overflow traps. And older languages like C or C++ do not have overflow checks also.

Ridiculous. It is obvious that humans cannot be trusted with writing correct arithmetics code.

AlienRobot2• 1 month ago

Zig raises overflow. There are +|= and +%= operators for clamped and wrapping addition.

Rust doesn't raise overflow by default. But you can just 123.checked_add(321). Now your code is unreadable, but it's overflow safe.

Honestly, based on the way I write code I'd rather something like an end of line comment. Like:

   var x = y + z; # wrapped

Because I'm very unlikely to mix wrapped/checked/clamped arithmetic in a single line. It can't be a compiler state like doing(wrapped) { x + y } because in Zig every line must be "compilable" by itself, without requiring context from other parts of the code. Function names are too verbose. Casting is too verbose. Having a statement-level modifier would be a good compromise.

codedokode5• 1 month ago

Nobody is going to write "checked_add" because that's too long and people are too lazy. The checked addition should be "+" operator.

heinrich5991• 1 month ago

Rust enables overflow checking in debug mode, you can (and I do) enable it in release mode as well.

Rust's default integer overflow in release mode is defined as well, it'll just wrap around. This makes it less likely to result in a vulnerability (unless you start writing unsafe Rust).

pornel2• 1 month ago

Additionally, integer overflow is less immediately dangerous in Rust, because buffer access is bounds-checked after the arithmetic. You can still get some logic bugs that eventually lead to vulnerabilities, but it's not an arbitrary memory write gadget.

zahlman3• 1 month ago

... do `unsafe {}` blocks not have the same semantics? I thought that was only about memory safety. Or are you thinking of cases where a wrapped-around integer gets interpreted as a pointer or something?

snvzz• 1 month ago

modern CPU architectures like RISC-V provide no overflow traps

Irrelevant. Simplicity here is better than complexity.

Unless you're handwriting assembly, this is a compiler's job.

techscruggs• 1 month ago

The incentives structure is deeply broken in the field of Security Research. They are the middle management of the FOSS world. Celebrated for dumping more work on volunteers. The more urgent the work, the more they are celebrated. Acknowledging the realistic impact of issues or the pragmatic implications of an issue are at odds with their incentives.

It's hard not to see them as bottom feeders of the software industry and I wish we would starting treating them like pariah. Submit the PR or STFU.

br0ceph• 1 month ago

Not suprised theres holes in codec implementations. They are extremely complicated structurally. Most modern codecs layer compression features endlessly in the pursuit of better compression. The specs are insanely bloated. Filesystems have the same problems, with huge bloated specs. You wouldn't mount an untrusted filesystem. Theres issues at all levels. The filesystem, the stream muxer, the codec. It would be nice if we could just use some simple uncompressed or lossless compression for video, and not need to have this mess of lossy codecs with endless compression features. But computers/networks still dont have the bandwidth to practically handle uncompressed video in 2026, altho audio can be. I doubt theres many issues with lpcm.

Twenty One Zero-Days in FFmpeg

Related Stories