CVE-2013-0876: Multiple integer overflows in the (1) old_codec37 and (2) old_codec47 functions in libavcodec/sanm.c in FFm...

Security readout for executives and security teams

CVE-2013-0876 is an old FFmpeg flaw in handling LucasArts Smush media data. A crafted media file could trigger integer overflows and out-of-bounds memory access. The public record says the impact is unspecified, so business risk depends on whether exposed systems process untrusted media with affected FFmpeg versions. Exposure is most likely where FFmpeg or libavcodec processes untrusted media files, uploads, email attachments, archives, or automated transcoding jobs. The source bundle does not identify downstream products or supported affected platforms beyond FFmpeg before 1.1.3. Treat this as a legacy dependency cleanup issue unless affected FFmpeg versions process untrusted media. The impact is unspecified, but memory-safety flaws in media parsers can become material when exposed to attacker-controlled files. Mitigation focus: Upgrade FFmpeg to 1.1.3 or a later vendor-supported release.; Check FFmpeg and distribution security guidance for the maintained fixed package.; Avoid processing untrusted Smush media on obsolete FFmpeg builds..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.