Hello.
This is a bug found with our fuzzer: https://github.com/daedalus/fuzzer/
**File**: `libavformat/vpk.c:89`
**Severity**: Medium — crafted 21-byte input crashes any FFmpeg-based application that opens a malicious `.vpk` file or stream
**Root cause**: `vpk_read_packet` divides `vpk->l...
Am I reading the thread correctly? This fuzzer found a “new” issue that was already identified in 2024? This matches what I’ve heard before about GenAI reporting known errors likely because they were trained on the internet as it’s data source.
With a history like ffmpegs, it’s just very likely that fuzzer findings have already been reported once. That the fuzzer is vibecoded is kinda irrelevant
Am I reading the thread correctly? This fuzzer found a “new” issue that was already identified in 2024? This matches what I’ve heard before about GenAI reporting known errors likely because they were trained on the internet as it’s data source.
With a history like ffmpegs, it’s just very likely that fuzzer findings have already been reported once. That the fuzzer is vibecoded is kinda irrelevant
This fuzzer doesn’t seem to be an AI/LLM based tool.
No bug discovered. No “vibecoding” detected.
Gotta love tech “journalism”.
In theory they can “find” new things, but typically it’s based on other training data.
Do you mean LLMs can find new bug classes or new bugs?
New bugs, not bug classes.
They also seem to do well with chaining low severity vulnerabilities to result in an overall high severity exploit.
deleted by creator