You may be joking, but if one found a RCE in FFMPEG that would apply to any AV transcoding it does, you would probably be able to target a boatload of websites.

You may be joking, but if one found a RCE in FFMPEG that would apply to any AV transcoding it does, you would probably be able to target a boatload of websites. Of course not on the scale as log4j, but it would still be pretty bad.