FFmpeg Powers Nearly Every Video You Watch. It Just Got Hit With 21 Zero-Days at Once

Almost every video you watched today passed through FFmpeg. Your YouTube playback, your Netflix stream, the clip you shot on your phone and converted to share — all of it. And the software propping up that enormous infrastructure just had 21 zero-day vulnerabilities disclosed at once. The more unsettling part: the code is maintained, in practice, by a small handful of volunteers.

What FFmpeg Actually Is

The shortest way to describe FFmpeg is the universal translator for audio and video. It takes video in any format, decodes it, re-encodes it into another, and handles the cutting, splicing, and compression in between. Most people have never heard the name. It is, nonetheless, hiding in nearly every place where digital video moves.

Consider the scale. YouTube, Netflix, and Twitch all lean on FFmpeg internally. Chrome ships with it. VLC is built around it. Android pulls in its code, and so do countless video-editing apps. Think of it as the invisible plumbing the entire global video industry sits on top of.

The problem is that 21 separate holes in that plumbing were just exposed simultaneously.

Why 21 Zero-Days Is the Scary Number

Quick definition first. A zero-day is a vulnerability that’s disclosed or exploited before a patch exists. The name comes from the idea that defenders have zero days to react. There’s no gap between the day a developer learns “oh, this hole exists” and the day an attacker can walk through it.

Video-processing flaws are especially dangerous for a specific reason: video files are data people open without a second thought. Download one booby-trapped clip, or let a messenger app auto-preview a video someone sent you, and the attack can fire. You don’t have to click “run.” You can be compromised by doing nothing more than looking.

And 21 at once is a signal — not a one-off slip, but a pattern. It strongly suggests similar weaknesses had been quietly piling up across old codec-handling code for years. One widely shared technical breakdown described the event as decades-old codecs “screaming awake” — ancient code, untouched for ages, all surfacing problems on the same day.

The AI Angle Is the Real Story

There’s one more detail worth dwelling on. These 21 vulnerabilities weren’t dug up by people. They were found, in bulk, by AI.

This cuts both ways. Read optimistically, AI-driven code analysis just surfaced long-buried bugs that human eyes had missed for years — a massive leap in security-research productivity. Read the other way, attackers can point the exact same tools at unguarded open-source code and scan it en masse.

That’s where the asymmetry bites. The side finding the bugs is now armed with AI and moving fast. The side that has to fix them is still a small group of volunteers. Discovery is automated; repair stays manual. The wider that gap grows, the more lopsided the fight gets for open-source projects.

The Real Problem Isn’t “21” — It’s the Headcount

I’d argue the heart of this story isn’t the number of bugs. It’s the structural reality that far too few people hold up this enormous piece of infrastructure.

Core open-source projects like FFmpeg are mostly carried by a few volunteers working for something close to nothing. A multi-trillion-dollar global video industry rides on their work, yet the people maintaining the code aren’t a company or even a team — they’re individuals. One person burning out or stepping away can bring the whole thing to a halt.

There’s a famous xkcd comic that captures this perfectly: a towering stack representing all modern digital infrastructure, with the entire structure balanced precariously on one small block “some random person in Nebraska has been thanklessly maintaining since 2003.” FFmpeg is one of those blocks. Giant companies have pulled this code for free, built enormous revenue on it, and quietly left the burden of security patching to volunteers.

The Question This Leaves Us With

What an ordinary user should do right now is simple: when your video player or operating system offers an update, apply it instead of putting it off. The moment a patch ships is the moment your defense begins.

But the bigger question is separate. In an era where AI finds vulnerabilities in bulk, who pays for the people and resources to fix them? If discovery keeps accelerating through automation while repair still leans on someone’s goodwill, then 21-at-once events like this one are only going to land more often, and harder.

What we mindlessly enjoy every day as digital convenience turns out to hang by a remarkably thin thread — and the FFmpeg incident lays that bare. Behind the services you use, which invisible volunteers are holding things together? It’s worth thinking about, at least once.