CVE-2016-6164: Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before...

Security readout for executives and security teams

This CVE affects older FFmpeg versions used to process media files. A crafted input involving sample size handling could trigger an integer overflow in FFmpeg's MOV index-building code. The public record says the impact is unspecified, so business risk depends on where FFmpeg processes untrusted media. Exposure is most likely where affected FFmpeg versions parse media from users, customers, partners, crawlers, or automated ingestion pipelines. The source bundle does not identify downstream products or CPEs. Treat this as a targeted hygiene item unless FFmpeg processes untrusted media in exposed workflows. The impact is unspecified, but remote input parsing makes stale FFmpeg versions worth removing promptly. Mitigation focus: Upgrade FFmpeg to 2.8.8, 3.0.3, 3.1.1, or a later supported release.; Check vendor guidance for products that bundle FFmpeg internally.; Restrict untrusted media processing until affected FFmpeg instances are upgraded..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.