CVE-2016-10190: Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before...

Security readout for executives and security teams

This flaw affects older FFmpeg versions when they fetch media over HTTP. A malicious web server could send a malformed response that corrupts heap memory and may allow code execution in the FFmpeg process. Business risk is highest for services that process user-supplied media URLs or ingest remote streams. Exposed systems are those running affected FFmpeg versions and fetching HTTP media from untrusted or attacker-controlled servers. Media ingestion, transcoding, thumbnailing, and URL preview workflows are the main concern. Pure local-file-only use has lower exposure based on the described attack path. Prioritize remediation where FFmpeg processes user-controlled URLs or internet-hosted media. The issue is old, but the impact is severe if vulnerable versions remain embedded in applications, containers, or appliances. Mitigation focus: Upgrade FFmpeg to 2.8.10, 3.0.5, 3.1.6, 3.2.2, or later fixed versions.; Apply distribution security updates for bundled FFmpeg or libav packages.; Restrict FFmpeg from fetching untrusted HTTP URLs where operationally possible..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.