CVE-2013-3670: The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly...

Security readout for executives and security teams

This is an old FFmpeg denial-of-service issue in development code from 2013. Crafted RLE media data could crash an application using the vulnerable libavcodec code. The source notes the bug was not shipped in FFmpeg 1.2.1 or earlier releases, so exposure is mainly custom builds from the affected git window. Likely limited to organizations that built or embedded FFmpeg directly from the affected 2013 git range. Standard packaged releases are less likely exposed based on the CVE note, which says the issue was not in 1.2.1 or earlier releases. Treat as a low-priority legacy exposure check unless your environment uses custom FFmpeg builds from the affected 2013 git window. Business impact is application crash or service interruption, with no source evidence of active exploitation or data compromise. Mitigation focus: Inventory applications and appliances embedding FFmpeg or libavcodec.; Check whether any builds came from FFmpeg git 20130328 through 20130501.; Use a supported FFmpeg release or code containing the referenced fixes..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.