CVE-2015-8365: The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8....

Security readout for executives and security teams

A flaw in FFmpeg's Smacker audio decoder can let crafted Smacker media crash software using vulnerable FFmpeg builds. The public record frames denial of service as the clear impact, with unspecified other impact only as a possibility. No source in the bundle reports active exploitation. Exposure is most likely where applications, services, or desktop systems process untrusted media through vulnerable FFmpeg versions, especially uploaded or externally supplied Smacker files. The source bundle does not identify specific downstream products beyond FFmpeg and distribution packages. Handle through normal vulnerability remediation unless the organization processes untrusted media at scale. Prioritize public-facing upload pipelines, content moderation systems, and media conversion services because a crash can affect availability. Mitigation focus: Upgrade FFmpeg to 2.6.5, 2.7.3, 2.8.3, or later supported vendor packages.; Apply relevant distribution security updates from Ubuntu, openSUSE, or Debian where applicable.; Check vendor guidance for downstream products embedding or bundling FFmpeg..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.