FFmpeg Zero-Days Expose Hidden Infrastructure Risk

A disclosure of 21 zero-day vulnerabilities in FFmpeg landed today and the HN thread was more alarmed than the headline suggests. FFmpeg is not just a media tool; it is embedded in browser pipelines, video ingest systems, surveillance infrastructure, and countless SaaS products. Any deployment that points FFmpeg at an attacker-controlled RTSP URL is exposed.

The key bit: most engineers using FFmpeg in their stack have no idea it is there. It gets pulled in as a dependency of a dependency, and nobody is auditing it. The comment thread noted that the reach of these bugs is what makes them serious, not just the bugs themselves.

This sits alongside the Arch Linux AUR malware incident (1,500+ packages affected) and the npm supply chain security thread from earlier in the week. The pattern across all three is the same: software you did not explicitly choose is running in your infrastructure, and it is a vector.