CVE-2013-7009: The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a poin...

Security readout for executives and security teams

CVE-2013-7009 is a flaw in FFmpeg's Apple RPZA video decoding. A malicious media file could make vulnerable FFmpeg versions crash, disrupting services that automatically inspect, transcode, or preview uploaded media. The sources do not show active exploitation. Exposure is most likely where FFmpeg before 2.1, or downstream packages containing that code, process untrusted Apple RPZA or QuickTime-style media. The provided affected-product metadata is incomplete, so confirm through local package and dependency inventory. Treat as a targeted patching item for media-processing infrastructure, especially upload or transcoding services. Business urgency is moderate unless vulnerable FFmpeg is internet-facing through user-supplied media workflows or supports critical availability-sensitive services. Mitigation focus: Upgrade FFmpeg to 2.1 or a vendor-supported fixed package.; Check downstream distribution advisories for backported fixes.; Limit untrusted media processing on systems that cannot be updated quickly..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.