And no, switching Buffer(number) to be zero-filled will bring more harm now, even from the security point of view. The best course of action imo is to deprecate Buffer(number) whatsoever and replace it with two separate methods. More info here: https://github.com/nodejs/node/issues/4660#issuecomment-1712...
I will make a separate post about that soon enough.
ffmpeg vulnerability allows reading local files and sending them over network using a specially crafted video file. This affects not only file conversion (including thumbnail generation), but also any other operations that involve ffmpeg processing your file — for example, ffprobe is affected.
This is not remote code execution, the vulnerability is limited to reading local files and sending them over network, but that is already bad enough.
For example, a specially crafted «video» file uploaded to your server by an attacker could read your website config/private keys/etc and send that to the attacker once you try to generate a thumbnail for it or just probe it with ffmpeg.
On a PC, you don't even need to open a file to get affected, just downloading it would be enough in some cases — video files are processed with ffmpeg for filemanager thumbnails (i.e. KDE Dolphin), for search indexers, etc.
That vulnerability is public, has code samples to reproduce and build a malicious file, and is not fixed atm.
The recommended quick fix is to rebuild ffmpeg without network support (--disable-network configure flag).