Heap Overflow in FFmpeg EXIF

(bugs.pwno.io)

44 points | by retr0reg 2 hours ago

3 comments

  • ComputerGuru 2 hours ago
    Nice find.

    (I don’t see what this being reported during the Christmas holidays has to do with not revealing the disclosure and patch timeline, a “note that delays should be attributed to Christmas” would have sufficed.)

  • renewiltord 46 minutes ago
    Hmm interesting. You can see recent edits to the file here https://github.com/FFmpeg/FFmpeg/commits/master/libavcodec/e...

    This specific issue is fixed here https://github.com/FFmpeg/FFmpeg/commit/4bfac71ecd96488dd2dc...

  • rvz 1 hour ago
    > Pwno is a AI cybersecurity startup...

    We all know that LLMs were used to find these vulnerabilities, specifically on high impact projects. That's fine.

    However, my only question is who actually provided the patch: The maintainers of FFmpeg? The LLM that is being used? Or the security researchers themselves after finding the issue?

    It seems that these two statements about the issue are in conflict:

    > We found and patched 6 memory vulnerabilities in FFmpeg in two days.

    > Dec, 2025: avcodec/exif maintainer provided patch.

    • tredre3 20 minutes ago
      PWNO provided a patch but it was rejected for being too large[1]. A maintainer fixed it himself[2]. I don't know if PWNO used a LLM but it seems clear that the maintainer had a preferred specific style in mind so it was likely hand written (albeit inspired by the initial patch).

      1. https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21258

      2. https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4bfac71ecd96488...

    • 9cb14c1ec0 35 minutes ago
      > We all know that LLMs were used to find these vulnerabilities

      How do we know that? You seem quite certain.

      • hedgehog 23 minutes ago
        They pitch their company as finding bugs "with AI". It's not hard to point one of the coding agents at a repo URL and have it find bugs even in code that's been in the wild for a long time, looking at their list that looks likely to be what they're doing.