diff --git a/demux/demux_lavf.c b/demux/demux_lavf.c
index 7857934642..d5598a942b 100644
--- a/demux/demux_lavf.c
+++ b/demux/demux_lavf.c
@@ -167,6 +167,8 @@ static const struct format_hack format_hacks[] = {
     BLACKLIST("bin"),
     // Useless, does not work with custom streams.
     BLACKLIST("image2"),
+    // Probably a security risk.
+    BLACKLIST("ffm"),
     // Image demuxers ("<name>_pipe" is detected explicitly)
     {"image2pipe", .image_format = true},
     {0}