A newly discovered critical vulnerability in the , the hole (, JFrog’s vulnerability research team lead, said in an email. “CSOs and developers should make sure their application security products alert them to the presence of this vulnerability, the sooner the better.”
The researchers said they have demonstrated the full exploit, achieving remote code execution on two independent targets: a Jellyfin media server (via automatic library scan) and a , principal security researcher at Sonatype, doubts full exploitation will be common. “I would be surprised to see broad, reliable exploitation of this specific bug in modern, hardened environments,” he told CSO in an email. “The more realistic near-term risk is denial-of-service (DoS), especially for services that process untrusted media at scale.”
Regardless, users of FFmpeg should upgrade to the patched version (8.1.2) as soon as possible if they know it’s in their application or are so informed by vendors.
A foundational dependency
JFrog notes FFmpeg is bundled with or linked to by virtually every media-processing application on every platform. It confirmed crashes against Kodi, mpv, ffmpegthumbnailer (used by GNOME, KDE, XFCE), Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, and OBS Studio, among others.
The vulnerability is a single bug in the codec decoder inside FFmpeg, but it’s a foundational dependency embedded in hundreds of downstream projects that cascades to every application that links libavcodec, an open source library that provides the core encoding and decoding capabilities for audio and video streams.
None of the affected projects introduced this bug, the researchers note. They inherited it silently through their dependency on FFmpeg. And most, they add, have no mechanism to detect or mitigate it independently.
This isn’t the first security issue in FFmpeg. As . In April, researchers at SentinelOne described .
Combatting supply chain vulnerabilities
Software supply chain vulnerabilities due to weaknesses in third party libraries and open source components have long been known as a security risk. Arguably the most infamous is the 2020 compromise of the update mechanism for ]
SBOMs critical
SBOMs are easy to create if a developer is building their own app. They’re harder to get from downloaded or commercial applications.
.
“An effective mechanism for sharing and using software data must be machine-processable and scalable,” the it notes. “The SBOM model achieves both by capturing software component data in a machine-processable format and supporting operations that analyze, share, and manage it. SBOM data can be mapped to other data sources such as security advisories or organization-level ‘approved/not approved’ software databases to improve other priority practices (e.g., secure software development, vulnerability management). SBOM will not resolve all software security and supply chain concerns, but it is a necessary step that enables and empowers risk-informed security decision making.”
Separately, last month the G7 cybersecurity working group, which includes the US, Germany, Canada, France, Italy, Japan, the United Kingdom, and the European Union, released joint guidance, Software Bill of Materials for AI – Minimum Elements, to help public and private sector stakeholders improve transparency in their artificial intelligence (AI) systems and supply chains.
However, JFrog’s Moravchik argues that while a software bill of materials is an essential first step, it’s only a starting point to more secure applications. “The teams that stay ahead pair it with continuous CVE mapping and exploitability analysis, scan at the binary level where these dependencies actually live, and disable codecs and features they don’t use,” he told CSO.
Infosec leaders also need to shift from reacting to proactively gating, he said. That means moving security enforcement upstream so risk is blocked at the door, through automated governance of every package, model, and agentic tool entering the pipeline paired with AI-powered threat detection, rather than remediating in the wild after a CVE drops.
SOCIAL SHARE CARD GENERATOR