Comment Re:90 days, huh? (Score 3, Interesting) 113
Someone else I saw talking about it did also mention that the codec the bug was in isn't even included by default, it needs to be enabled at compile-time to be available.
So it might not be enough to just code up an exploit, but you'd need the target to be running a version of FFMPEG with the vulnerable codec compiled in.