--- title: AI-Enabled Security Researchers Discover How a Crafted... description: JFrog Security Research disclosed 'PixelSmash' (CVE-2026-8461, CVSS 8.8), a critical 16-year-old heap out-of-bounds write vulnerability in FFmpeg's MagicYUV... canonical: https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC | daily.dev og:description: JFrog Security Research disclosed 'PixelSmash' (CVE-2026-8461, CVSS 8.8), a critical 16-year-old heap out-of-bounds write vulnerability in FFmpeg's MagicYUV... og:url: https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa og:image: https://api.daily.dev/og/posts/oEQKbxaFA.png og:image:alt: AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 1 upvotes · 0 comments ## Summary JFrog Security Research disclosed 'PixelSmash' (CVE-2026-8461, CVSS 8.8), a critical 16-year-old heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder. Exploitation requires only delivering a crafted AVI, MKV, or MOV file to any application using FFmpeg's libavcodec, enabling Remote Code Execution or Denial of Service with no authentication required. Affected applications span desktop video players (Kodi, mpv), media servers (Jellyfin, Nextcloud), cloud transcoding services, and IoT/NAS devices. Researchers demonstrated full RCE on Jellyfin and Nextcloud by uploading a 50 KB AVI file. Mitigations include upgrading to FFmpeg 9.0+, rebuilding without the MagicYUV decoder, or applying a 7-line patch to libavcodec/magicyuv.c. The discovery was aided by AI-powered security research tools and has reignited debate about memory-safe alternatives to legacy C-based media libraries. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons](https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v) · JFrog · 3 upvotes · 0 comments - [FFmpeg fixes PixelSmash flaw in widely used video decoder](https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5) · BleepingComputer · 37 upvotes · 0 comments - [Hole in widely-used FFmpeg codec could crash media servers or enable RCE](https://daily.dev/posts/hole-in-widely-used-ffmpeg-codec-could-crash-media-servers-or-enable-rce-cflqjb7as) · CSO Online · 12 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#backend](https://daily.dev/tags/backend) [View this post on daily.dev](https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC","url":"https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa"},"datePublished":"2026-07-26T09:21:55.802Z","dateModified":"2026-07-26T09:22:18.714Z","description":"JFrog Security Research disclosed 'PixelSmash' (CVE-2026-8461, CVSS 8.8), a critical 16-year-old heap out-of-bounds write vulnerability in FFmpeg's MagicYUV...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e4c2d62bb9f537c352fef5a7cdf7bcd5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e4c2d62bb9f537c352fef5a7cdf7bcd5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,backend","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC"}]} ```