Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

FFmpeg MagicYUV decoder heap out-of-bounds write remote code execution flaw (CVE-2026-8461)

Vulnerability
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

FFmpeg disclosed CVE-2026-8461, a heap out-of-bounds write in the MagicYUV decoder that can crash FFmpeg-based applications and create remote code execution risk under specific conditions. The flaw affects software using libavcodec and is reachable through crafted AVI, MKV, or MOV files. FFmpeg 8.1.2 fixes the issue, reducing exposure across media servers and preview pipelines that trust FFmpeg to process untrusted input.

Timeline

  1. 22.06.2026 03:00 1 articles · 22h ago

    JFrog reports CVE-2026-8461 in FFmpeg's MagicYUV decoder

    Initial Disclosure

    JFrog reported CVE-2026-8461 to the FFmpeg security team after finding a heap out-of-bounds write in the MagicYUV decoder that could crash FFmpeg-based applications and, under some conditions, enable remote code execution on Jellyfin or denial of service on other libavcodec users.

    Show sources
    Open in new tab
  2. 22.06.2026 03:00 1 articles · 22h ago

    FFmpeg 8.1.2 fixes the PixelSmash vulnerability

    Mitigation Patch Update

    FFmpeg released version 8.1.2 to fix CVE-2026-8461, and downstream maintainers including Jellyfin updated their bundled FFmpeg while PhotoPrism worked on a file-format blocklist to reduce exposure to malicious AVI, MKV, or MOV files.

    Show sources
    Open in new tab
  3. 22.06.2026 03:00 2 articles · 22h ago

    PixelSmash exposure spans Jellyfin, Nextcloud, and other FFmpeg-based media apps

    Campaign Scope Update

    JFrog detailed that PixelSmash can be triggered by crafted AVI, MKV, or MOV files opened directly, detected during thumbnail generation, or processed through automated media ingestion, and demonstrated remote code execution on Jellyfin and Nextcloud when ASLR is disabled or bypassed. The same analysis also extended the risk to Kodi, Emby, PhotoPrism, OBS Studio, GNOME/KDE/XFCE thumbnail generators, and other projects that trust FFmpeg to handle untrusted input safely.

    Show sources
    Open in new tab