A heap out-of-bounds write vulnerability (CVE-2026-8461), dubbed 'PixelSmash', has been discovered in FFmpeg's MagicYUV decoder. The flaw affects any application using libavcodec, including Kodi, OBS Studio, Nextcloud, PhotoPrism, Emby, and Jellyfin. Researchers at JFrog demonstrated full RCE against a Jellyfin 10.11.9 server by dropping a crafted AVI file into its media library, which triggers an automatic ffprobe scan that fires the exploit. RCE requires ASLR to be disabled or chained with a separate info-disclosure bug; otherwise the flaw reliably causes denial-of-service. Plex is unaffected due to a custom FFmpeg build with a minimal decoder allowlist. FFmpeg 8.1.2 (released June 17) patches the issue. The vulnerability is considered a supply-chain risk because the MagicYUV decoder is embedded in hundreds of projects that trust FFmpeg to safely handle untrusted media input.
