CVE-2012-6616: The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attacker...

Security readout for executives and security teams

This issue can let a remote party crash vulnerable FFmpeg-based media processing by providing specially crafted 3GPP text/subtitle data. The public record describes denial of service, not data theft or code execution. Business urgency depends on whether old FFmpeg builds process untrusted media files. Most likely exposure is servers, desktop tools, or embedded products running FFmpeg before 1.0.2 and parsing untrusted 3GPP/MP4 mov_text subtitle data. Transitive or statically linked FFmpeg copies should be checked because the source bundle does not enumerate affected downstream products. Prioritize remediation where old FFmpeg handles customer-supplied media or public uploads. The known impact is service disruption, so this is usually below data compromise issues but still relevant for availability-sensitive media services. Mitigation focus: Upgrade FFmpeg to 1.0.2 or a current vendor-supported release.; Identify bundled, static, container, and appliance copies of FFmpeg.; Restrict untrusted 3GPP/mov_text processing until vulnerable builds are retired..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.