4 comments

  • ComputerGuru3 hours ago
    Nice find.<p>(I don’t see what this being reported during the Christmas holidays has to do with not revealing the disclosure and patch timeline, a “note that delays should be attributed to Christmas” would have sufficed.)
  • renewiltord2 hours ago
    Hmm interesting. You can see recent edits to the file here <a href="https:&#x2F;&#x2F;github.com&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;commits&#x2F;master&#x2F;libavcodec&#x2F;exif.c" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;commits&#x2F;master&#x2F;libavcodec&#x2F;e...</a><p>This specific issue is fixed here <a href="https:&#x2F;&#x2F;github.com&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;commit&#x2F;4bfac71ecd96488dd2dcd5649e08edb039a17a8b" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;commit&#x2F;4bfac71ecd96488dd2dc...</a>
  • helge92101 hour ago
    <a href="https:&#x2F;&#x2F;x.com&#x2F;FFmpeg&#x2F;status&#x2F;2006773495066464580" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;FFmpeg&#x2F;status&#x2F;2006773495066464580</a><p>&gt; Seeing as this has made the orange site, let it be known this person is a model security researcher.<p>&gt; The issue was not in any FFmpeg release, and a report was sent three days after a new code was added to FFmpeg Git.<p>&gt; There was no big CVE ADVISORY &quot;MUH SECURITEH&quot; &quot;you need to fix this now or you will be hacked and the world will end&quot; associated with the report.
    • GaryBluto46 minutes ago
      Is the FFmpeg Twitter account managed by a developer&#x27;s teenage son? No matter what point that they try convey, it&#x27;s always stated in an obnoxious manner.
      • bgwalter14 minutes ago
        Maybe they should hire Mario Nawfal for their announcements:<p>&quot;&quot;&quot; BREAKING: AI FOUND VULNERABILITY IN FFMPEG!<p>After decades of human struggle, humans no longer call the shots.<p>Pwno decided to take the leap. They did not just find a vulnerability---they found a BOMBSHELL! What took developers weeks to write, AI analyzed in SECONDS! &quot;&quot;&quot;
    • bgwalter1 hour ago
      This is another drawback of security research, but one that had already existed before &quot;AI&quot; with ossfuzz.<p>You basically cannot commit in public to the main branch and audit and test everything 3 months before a release, because any error can be picked up, will be publicized and go into the official statistics.
      • nospice37 minutes ago
        &gt; ... go into the official statistics.<p>There are no &quot;official&quot; statistics. None of this matters. If we judged projects by the number of security holes they had, then no one would be using ffmpeg, which had hundreds of serious vulns.<p>Vulnerability research is useful insofar that the bad guys are using the same techniques (e.g., the same fuzzing tools), so any bugs you squash make it harder for others to attack you. If your enemy is a nation state, they might still pack your laptop &#x2F; phone &#x2F; pager with explosives, but the bar for that is higher than popping your phone with a 0-day.<p>Vulnerability research is demonstrably <i>not</i> useful for improving the security of the ecosystem in the long haul. That&#x27;s where sandboxing, hardening, and good engineering hygiene come into play. If you&#x27;re writing a browser or a video decoder in C&#x2F;C++, you&#x27;re going to have exploitable bugs.
        • toast019 minutes ago
          &gt; Vulnerability research is demonstrably not useful for improving the security of the ecosystem in the long haul. That&#x27;s where sandboxing, hardening, and good engineering hygiene come into play. If you&#x27;re writing a browser or a video decoder in C&#x2F;C++, you&#x27;re going to have exploitable bugs.<p>IMHO, vulnerability research is the stick that drives the ecosystem towards all those things. Reports of vulnerabilities in the codec for Rebel Assult videos (or whatever) leads one to disable codecs other than those they need. Reports of vulnerabilities in playlist support leads one to disable playlist support where it&#x27;s unnecessary and run transcodes in a chroot sandbox with no network access. Reports of buffer oveflows leads one to prefer implementation in memory safe languages where available with sufficient performance and also to sandbox when possible.
          • tptacek11 minutes ago
            I mostly agree, and further would say that this doesn&#x27;t really conflict with the preceding comment.
  • rvz2 hours ago
    &gt; Pwno is a AI cybersecurity startup...<p>We all know that LLMs were used to find these vulnerabilities, specifically on high impact projects. That&#x27;s fine.<p>However, my only question is who actually provided the patch: The maintainers of FFmpeg? The LLM that is being used? Or the security researchers themselves after finding the issue?<p>It seems that these two statements about the issue are in conflict:<p>&gt; We found <i>and patched 6 memory vulnerabilities</i> in FFmpeg in two days.<p>&gt; Dec, 2025: <i>avcodec&#x2F;exif maintainer provided patch.</i>
    • tredre31 hour ago
      PWNO provided a patch but it was rejected for being too large[1]. A maintainer fixed it himself[2]. I don&#x27;t know if PWNO used a LLM but it seems clear that the maintainer had a preferred specific style in mind so it was likely hand written (albeit inspired by the initial patch).<p>1. <a href="https:&#x2F;&#x2F;code.ffmpeg.org&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;pulls&#x2F;21258" rel="nofollow">https:&#x2F;&#x2F;code.ffmpeg.org&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;pulls&#x2F;21258</a><p>2. <a href="https:&#x2F;&#x2F;code.ffmpeg.org&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;commit&#x2F;4bfac71ecd96488dd2dcd5649e08edb039a17a8b" rel="nofollow">https:&#x2F;&#x2F;code.ffmpeg.org&#x2F;FFmpeg&#x2F;FFmpeg&#x2F;commit&#x2F;4bfac71ecd96488...</a>
    • 9cb14c1ec01 hour ago
      &gt; We all know that LLMs were used to find these vulnerabilities<p>How do we know that? You seem quite certain.
      • hedgehog1 hour ago
        They pitch their company as finding bugs &quot;with AI&quot;. It&#x27;s not hard to point one of the coding agents at a repo URL and have it find bugs even in code that&#x27;s been in the wild for a long time, looking at their list that looks likely to be what they&#x27;re doing.
        • bgwalter1 hour ago
          The list is pretty short though for 8 months. ossfuzz has found a lot more even with the fuzzers often not covering a lot of the code base.<p>Manually paying <i>people</i> to write fuzzers by hand would yield a lot more and be less expensive than data centers and burning money, but who wants to pay <i>people</i> in 2026?
          • tptacek10 minutes ago
            Bugs are not equivalently findable and different techniques surface different bugs. The direct comparison you&#x27;re trying to draw here doesn&#x27;t hold.
          • hedgehog46 minutes ago
            I can&#x27;t speak to what exactly this team is doing but I haven&#x27;t seen any evidence that with-robot finds less bugs than without-robot. I do have some experience in this area.