FFmpeg serves as the industrial standard for mobile applications handling audio and video, parsing containers such as MP4, MOV, AVI, and RTSP into individual streams. The library ships with roughly 543 registered CVEs, many of which appear in bug bounty scopes.
Scope of the Problem
According to the Quokka “State of Mobile App Security 2026” report covering more than 150,000 applications, critical CVEs in third-party components affect 11% of Android and 13% of iOS apps. High-severity vulnerabilities appear in 65% of Android applications. While FFmpeg is not the only affected framework, it consistently ranks among the leaders.
Selected CVEs
PixelSmash (CVE-2026-8461), disclosed by JFrog in June 2026, is a heap out-of-bounds write in the MagicYUV decoder (libavcodec/magicyuv.c) that leads to full RCE. When slice_height is odd, the decoder writes extra pixel rows beyond the allocated buffer, corrupting the adjacent AVBuffer structure and redirecting its free pointer to system().
HTTP chunked overflow (CVE-2016-10190), rated CVSS 9.8, resides in libavformat/http.c. A malicious server sends a negative chunk size that bypasses size checks and causes recv() to write an enormous amount of data, overwriting the read_packet pointer inside AVIOContext and achieving RCE.
The AV1 RTP depacketizer vulnerability (DFVULN-127) discovered by the depthfirst agent in 2026 allows RCE with a single 183-byte RTP packet. Manipulation of the pktpos variable in libavformat/rtpdec_av1.c leads to an out-of-bounds write inside av_grow_packet, again hijacking an AVBuffer free pointer.
Locating FFmpeg in APKs
After unpacking with apktool, analysts search ABI directories for version strings:
- find . -iname "*.so" | xargs -I{} sh -c 'strings {} 2>/dev/null | grep -q "FFmpeg version" && echo {}'
Four common integration patterns exist: static linking inside an SDK library, dynamic linking of separate libavcodec.so and libavformat.so files, Java/Kotlin wrappers such as mobile-ffmpeg, and CLI binaries executed via Runtime.exec().
Version Identification and Build Configuration
Version information is embedded as plain text. The string “FFmpeg version” or the Lavc marker (e.g., Lavc56.60.100) reveals the exact release. NDK toolchain dates provide a rough age indicator when version strings are stripped. The full configure line listing enabled decoders, demuxers, and protocols can be recovered with strings or by enumerating exported symbols ending in _demuxer and _decoder.
Protocol handlers are high-value targets because exploitation requires only control of the URL passed to avformat_open_input().
