CVE-2013-0877: The old_codec37 function in libavcodec/sanm.c in FFmpeg before 1.1.3 allows remote attackers to have an uns...

Security readout for executives and security teams

CVE-2013-0877 is an old FFmpeg media-decoder flaw. A crafted LucasArts Smush media file could trigger out-of-bounds access during decoding. The public record says impact is unspecified, so business risk depends on whether vulnerable FFmpeg versions process untrusted media. Exposure is most likely in systems running FFmpeg before 1.1.3, or products bundling that code, where users or external parties can supply media files for decoding or thumbnailing. Medium operational priority if vulnerable FFmpeg processes untrusted media; lower priority for isolated or non-media systems. The age of the issue reduces urgency, but legacy and bundled decoders are common blind spots. Mitigation focus: Upgrade FFmpeg to a version containing the 1.1.3 fix or later.; Check operating-system and application vendor advisories for bundled FFmpeg copies.; Prioritize services that decode user-supplied or internet-sourced media..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.