Zero-Day FFmpeg Vulnerability Lets Anyone Steal Files from Remote Machines

The vulnerability was discovered on January 12, 2016, by Russian programmer Maxim Andreev in the current stable builds of the FFmpeg software, and it would appear that it lets anyone who has the necessary skills to hack a computer to read local files on a remote machine and send them over the network using a specially crafted video file.

The vulnerability is limited to reading local files and send them over the network, not to remote code execution, but it’s enough to do some damage. The FFmpeg developers are aware of the issue, and they are trying to patch it as we speak. James Darnley of FFmpeg suggests that disabling HLS while building the package should do the trick until a fix is committed.