Most of them involve very weird and unlikely scenarios and bad security practices or access to the ffmpeg binaries and being allowed to run arbitrary commands at an elevated permission.

In and of itself there's not a massive issue from what I can see, they're entry vectors that can lead to worse situations.

That's not to say they're not serious but if a Russian hacking group is using one of them it's in conjunction with other exploits or security flaws. Which is common in practice when it comes to decoding.

Its 21 issues. And they've been human validated, as far as I can tell.