[Security] Duplicate Cleaner appears to bundle or use an outdated FFmpeg build.

[askdddc]

This is an old 2021 FFmpeg git build and is below FFmpeg 8.1.2, the version reported to contain the fix for CVE-2026-8461.

Impact:

CVE-2026-8461 is reported to affect FFmpeg versions before 8.1.2 and may allow remote code execution when a crafted media file is processed.

If Duplicate Cleaner uses this bundled FFmpeg build to scan, probe, thumbnail, fingerprint, or compare media files, scanning a folder containing a crafted malicious video file may trigger the vulnerability and could potentially lead to code execution.

Suggested fix:

Please update the bundled FFmpeg used by Duplicate Cleaner to FFmpeg 8.1.2 or later, or otherwise include the upstream fix for CVE-2026-8461.

[DigitalVolcano]

Thanks for the note. It's on the list to do. It was a special build for DC5 so I'll need to either rebuild or source a newer LGPL build.

Note you can replace the ffmpeg.exe in your Duplicate Cleaner Program files folder - it will still work and you'll get any advantages of a newer/custom build.

[therube]

Note that not all versions of ffmpeg will run on Win7.

Like from, ffmpeg 8.1.2 builds, the "essentials_build" will work,
where the "full_build" will not (due to tool chains used to compile the program & other factors).


(There are other builds, from others, where full builds do work.)