I find it weird calling the recent FFmpeg security vulnerability a RCE [1]. Where is that remote coming from? Yes sure, some web applications use FFmpeg and passes untrusted files to it. *Those* have a RCE. Setting the CVSS attack vector to "network" seems overinflating. By that standard any software that somebody built a webapp around is "network" facing. And let's not even talk about setting attack complexity to "low" but admitting that it only works with ASLR disabled. [1] https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/ #FFmpeg #vulnerability #infosec #PixelSmash