Security researchers have disclosed 21 zero-day vulnerabilities in FFmpeg, the open-source library that handles video and audio processing in most of the software you use.
A research team published findings identifying 21 previously unknown flaws in FFmpeg. Zero-days carry no available patch at the time of disclosure, meaning every system running the affected code is exposed until an update ships. FFmpeg's codebase is enormous, spans formats from ancient codecs to modern streaming protocols, and processes untrusted media input by design. That combination has made it a recurring target for this kind of work.
FFmpeg is not a niche dependency. It is embedded in browsers, video conferencing tools, streaming platforms, content delivery pipelines, and countless media applications. Vulnerabilities in it are theoretically reachable from malicious media files, the kind a user might open without a second thought. Twenty-one zero-days in a single audit represents a significant exposure across a very wide attack surface.
FFmpeg has accumulated security patches for years, partly a product of its ubiquity and partly a product of how difficult it is to secure a codebase that intentionally ingests arbitrary, malformed input. The real question now is whether patches arrive and get adopted faster than those flaws can be weaponized.