CVE-2013-0866: The aac_decode_init function in libavcodec/aacdec.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows re...

Security readout for executives and security teams

This flaw affects old FFmpeg AAC decoding. A malicious AAC audio file with too many channels could make FFmpeg access memory outside an expected array. The public record says the impact is unspecified, so business risk depends on whether exposed systems still process untrusted media with vulnerable FFmpeg builds. Exposure is most likely in legacy media services, upload pipelines, transcoders, scanners, or appliances using vulnerable FFmpeg/libavcodec versions, including bundled builds. Current maintained distributions are less likely exposed, but static or vendor-embedded FFmpeg copies require separate verification. Prioritize remediation where old FFmpeg handles user-supplied media. This is not a confirmed active-exploitation emergency from the provided sources, but media parsers are high-risk attack surfaces and vulnerable legacy builds should not remain internet-facing. Mitigation focus: Upgrade FFmpeg to 1.0.4, 1.1.2, or a later vendor-supported release.; Apply relevant Debian or Gentoo security updates where those distributions are used.; Identify applications bundling or statically linking FFmpeg and update those copies separately..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.