Comment People either can't - or don't - read (Score 2) 113
I'm going to break this down for everyone since there seems to be a distinct lack of comprehenhsion in the comments section.
1) This bug has nothing to do with playing videos on a console and it instead has to do with playing extracted video from a console, specifically - extracted video from Star Wars Rebel Assault 2 - a computer/Playstation (1) game from 1995/96.
2) There is a bit of custom code designed specifically around this little used codec to account for video artifacting in the first handful of frames. Let's call a spade a spade - it's a custom filter built right into the FFmpeg code.
3) It's a use-after-free (UAF) exploit - which can lead to remote code execution.
4) Triggering this bug doesn't require someone to actually trick the user into watching the videos from Rebel Assult 2 - merely embedding enough into your file that FFmpeg will execute that code path. I'm not versed enough to list out the different containers FFmpeg might be convinced to run this code against, but having watched it chew through mislabeled files before I assume it's more than one.
5) I don't disagree with the project maintainers that companies that have a stake in open-source software should contribute towards its maintenance.
6) I do disagree with them about this being "CVE slop". AI is an arms race. If Google is using AI to detect and contribute bugs, there's no reason to think that hacker groups aren't using the exact same tools searching for exploitable bugs and not reporting them. It's very much like mining bitcoin - someone is going to find that next address. Do you want the hat to be black or white?