Videolan should fix the bug. Secunia should report the bug to ffmpeg. If the bug's fixed by a later version of ffmpeg then great, use a later version. If it's not, fix the bug, wait for ffmpeg to have a fixed update and off you go.

To give you a similar example, have a look at this post about the impact of vulnerabilities in third party libraries on commercial forensic products[1].

I would suspect that expert witnesses relying on this could have a case argued against them in court regarding the integrity of the application data and their processes if they're not prepared.

[1] - https://www.cert.org/blogs/certcc/2013/07/forensics_software...