FFmpeg Security Analysis: 21 Zero-Day Vulnerabilities Discovered by Autonomous Agents
Depthfirst has identified 21 zero-day vulnerabilities in FFmpeg using a specialized autonomous security agent. These findings include several critical memory corruption issues, some of which remained latent for over 20 years, and a demonstrated Remote Code Execution (RCE) exploit primitive in the AV1 RTP depacketizer.
AI-Driven Vulnerability Discovery
Depthfirst's security agent differs from standard coding agents by focusing on adversarial inputs and threat modeling rather than feature implementation. The system maps the attack surface, identifies exposed parsers, and traces data flow to vulnerable sinks. Unlike theoretical analysis, the agent produces concrete, reproducible Proof-of-Concept (PoC) inputs to confirm reachability and exploitability.
This approach proved highly cost-effective, discovering 21 vulnerabilities for approximately $1,000—roughly 10% of the cost associated with similar efforts using other advanced models like Anthropic's Mythos.
Summary of Discovered Vulnerabilities
The 21 vulnerabilities span various components, from the TS demuxer to the VP9 decoder. Eight have been assigned CVEs, while others are tracked internally by Depthfirst.
CVE-Assigned Vulnerabilities
| CVE | Type | Component | Note |
|---|---|---|---|
| CVE-2026-39210 | Heap Buffer Overflow | TS demuxer | Lacked length bounds checks; introduced in 2010. |
| CVE-2026-39211 | Integer Overflow | swscale | Size factor formula lacked upper bounds; introduced in 2010. |
| CVE-2026-39212 | Stack Overflow | ffmpeg_opt.c |
Recursive option parsing without depth limit; July 2025 regression. |
| CVE-2026-39213 | Heap Buffer Overflow | yuv4mpegenc | Missing dimension validation against packet size; introduced in 2023. |
| CVE-2026-39214 | Stack Buffer Overflow | SDT implementation | Failed to track remaining space; latent since 2003. |
| CVE-2026-39215 | Heap Buffer Overflow | update_mb_info() |
Logic error allowing 12-byte overflow; introduced in 2012. |
| CVE-2026-39216 | Heap Buffer Overflow | img2enc.c |
Unbounded dimension-derived size; introduced in 2012. |
| CVE-2026-39217 | Heap Buffer Overflow | VP9 decoder | Missing reallocations in tile thread buffers; March 2025 regression. |
| CVE-2026-39218 | Heap Buffer Overflow | DASH demuxer | Failed to reject negative duration values; introduced in 2017. |
Other Notable Findings
- DFVULN-127 (Heap Buffer Overflow): Found in the RTP AV1 depacketizer; allows for an RCE primitive.
- DFVULN-122 (Heap Buffer Overflow): Found in the RTP MPEG-4 depacketizer; latent since 2005.
- DFVULN-123 (Integer Overflow): Found in the RTP LATM depacketizer; allows reading ~1 GB past a heap buffer.
- DFVULN-120 (Integer Underflow): Found in the AVI demuxer; can trigger a ~2 GB allocation leading to Denial of Service (DoS).
Deep Dive: RCE in AV1 RTP Depacketizer
One of the most critical findings is a heap buffer overflow in libavformat/rtpdec_av1.c. This vulnerability is reachable via a standard RTSP stream request (ffmpeg -i rtsp://attacker/stream) without requiring special flags or user interaction beyond opening the stream.
The Root Cause
The vulnerability exists in the handling of Temporal Delimiter (TD) OBUs. The depacketizer is designed to ignore and remove TD markers. However, the code advances the output cursor (pktpos) by the attacker-specified obu_size without allocating corresponding memory via av_grow_packet.
This creates two critical failures:
- Poisoned Write Cursor: The
pktposis pushed forward, but the underlying buffer is not enlarged. - Attacker-Controlled Content: Because the input pointer (
buf_ptr) is not advanced, the next iteration re-parses the TD's own bytes as a new OBU, allowing the attacker to control exactly what is written at the poisoned offset.
The Exploitation Path
By carefully tuning the obu_size to 148, an attacker can cause writes to begin at pkt->data[148]. Due to FFmpeg's 64-byte alignment, the AVBuffer bookkeeping struct lands immediately after the data buffer. The AVBuffer.free function pointer is located at offset 152.
By crafting a specific OBU payload, the attacker can overwrite the free pointer with a controlled address. When the buffer is subsequently released (triggered by a third fabricated OBU that forces a re-allocation), FFmpeg invokes the corrupted free pointer, granting the attacker control of the instruction pointer (RIP).
Community Perspectives and Security Implications
The discovery of these vulnerabilities has sparked discussion regarding the inherent risks of parsing complex media formats in C.
The Need for Sandboxing
Many community members emphasize that FFmpeg should never be run outside of a sandbox when processing untrusted content.
"Ffmpeg is absolutely not something you should be running outside of a sandbox if you're touching any untrusted or user-supplied content. I know that people do, and these people are taking unreasonable risks."
Experts suggest using VMs or tools like gVisor to isolate the process, as the complexity of media codecs makes them nearly impossible to secure completely.
The Role of AI in Security
While the findings demonstrate the power of LLMs, some critics argue that the industry is focusing too much on reporting and not enough on remediation. There is a call for AI agents to move beyond filing bug reports and instead generate pull requests (PRs) that fix the vulnerabilities directly to reduce the burden on open-source maintainers.
Memory Safety
The prevalence of buffer overflows and integer underflows in these findings highlights the ongoing debate over memory-safe languages. Some contributors noted that many of these issues would be non-existent or easily caught in languages like Rust or Go, which handle arithmetic overflows and memory boundaries more strictly.