21 Bytes Can Crash FFmpeg: Inside the Vibecoded Fuzzer That Found What Years of Audits Missed
Twenty-one bytes. That is the entire attack. A file smaller than a URL, with four zero bytes sitting at exactly the right offset, crashes any FFmpeg-based application that opens it and reads a packet. Not memory corruption, not some exotic heap trick. A division by zero, in code that has been shipping for years, in one of the most fuzzed codebases on the planet. The person who found it, Darío…
The story revolves around a bug discovered in FFmpeg, a software framework for handling audio and video. This bug can be triggered by a file of just 21 bytes, which is smaller than a typical URL. The attack exploits a division by zero error in the code that handles Sony PS2 VPK audio files. This discovery was made possible by an AI-powered fuzzer, which is an automated tool that generates test cases to find vulnerabilities in software.
The fuzzer was built using AI assistance, and the person who found the bug, Darío Clavijo, used this AI tool to create the fuzzer. The crash was observed on a single machine and took around 10 hours to discover, with a corpus size of 13,188 entries. The severity of the bug is rated as medium, resulting in a denial of service rather than code execution.
The fix suggested for this bug is quite simple, involving a guard that checks if the channel count is zero and returns an error. However, it's worth noting that a similar guard was proposed on the ffmpeg-devel mailing list back in November 2024, but it was not implemented. This bug was found in a codebase that has been heavily fuzzed, indicating the effectiveness of AI-assisted fuzzing tools.
The debate surrounding the use of AI in software testing is a significant part of the story, highlighting both the potential benefits and the need for human oversight and discipline in the process.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
