Twenty One Zero-Days in FFmpeg

A security agent developed by depthfirst discovered 21 zero-day vulnerabilities in FFmpeg, a widely-used media processing library, with some dormant for 15-20 years and one demonstrating remote code execution capabilities. The agent successfully identified these vulnerabilities at a significantly lower cost than previous security efforts by Google and Anthropic, and importantly, produced reproducible proof-of-concept inputs that confirm each finding is real and exploitable rather than theoretical.