CVE-2026-8461

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2

Description A heap out-of-bounds write flaw, dubbed PixelSmash, exists in the libavcodec library, specifically within the MagicYUV decoder. The issue stems from a rounding mismatch in the slice handling code where improper validation of the slice height variable allows an attacker to manipulate buffer memory. By providing a specially crafted media file in AVI, MKV, or MOV format (as small as 50 KB), a remote attacker can cause a denial-of-service or execute arbitrary code.

Technical exploitation involves overflowing the chroma plane buffer to overwrite the AVBuffer structure, which contains a function pointer. By replacing this pointer with the address of the system() function and providing a shell command, the attacker can achieve remote code execution during normal frame cleanup when av frame unref() is called. This can be triggered without user interaction (zero-click) through automatic media library scanning, metadata extraction, or thumbnail generation in applications such as Jellyfin, Nextcloud, Kodi, Emby, Immich, and OBS Studio. The vulnerability is considered a supply chain risk due to the widespread integration of libavcodec across various media servers, cloud platforms, and IoT devices.

Recommendations Update FFmpeg to version 8.1.2 or later. As a temporary mitigation, disable the MagicYUV decoder or restrict the processing of untrusted media files.