--- title: FFmpeg fixes PixelSmash flaw in widely used video decoder description: A heap out-of-bounds write vulnerability (CVE-2026-8461), dubbed 'PixelSmash', has been discovered in FFmpeg's MagicYUV decoder. The flaw affects any... canonical: https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: FFmpeg fixes PixelSmash flaw in widely used video decoder | daily.dev og:description: A heap out-of-bounds write vulnerability (CVE-2026-8461), dubbed 'PixelSmash', has been discovered in FFmpeg's MagicYUV decoder. The flaw affects any... og:url: https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5 og:image: https://api.daily.dev/og/posts/3SxHPnzu5.png og:image:alt: FFmpeg fixes PixelSmash flaw in widely used video decoder og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # FFmpeg fixes PixelSmash flaw in widely used video decoder **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 37 upvotes · 0 comments ## Summary A heap out-of-bounds write vulnerability (CVE-2026-8461), dubbed 'PixelSmash', has been discovered in FFmpeg's MagicYUV decoder. The flaw affects any application using libavcodec, including Kodi, OBS Studio, Nextcloud, PhotoPrism, Emby, and Jellyfin. Researchers at JFrog demonstrated full RCE against a Jellyfin 10.11.9 server by dropping a crafted AVI file into its media library, which triggers an automatic ffprobe scan that fires the exploit. RCE requires ASLR to be disabled or chained with a separate info-disclosure bug; otherwise the flaw reliably causes denial-of-service. Plex is unaffected due to a custom FFmpeg build with a minimal decoder allowlist. FFmpeg 8.1.2 (released June 17) patches the issue. The vulnerability is considered a supply-chain risk because the MagicYUV decoder is embedded in hundreds of projects that trust FFmpeg to safely handle untrusted media input. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the PixelSmash vulnerability in FFmpeg and which CVE does it correspond to? PixelSmash is a heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder, tracked as CVE-2026-8461 with a severity score of 8.8. It results from an inconsistency between how the frame allocator and decoder compute chroma plane heights, and can be triggered by opening a malicious AVI, MKV, or MOV file or scanning a directory containing one. _Teams patching media pipelines can track FFmpeg security fixes like this one on daily.dev._ ### Which version of FFmpeg fixes CVE-2026-8461 and when was it released? FFmpeg 8.1.2 fixes CVE-2026-8461, released on June 17 after JFrog reported the flaw to the FFmpeg security team on May 13. Jellyfin also updated its bundled FFmpeg build, while PhotoPrism is adding a file format blocklist and Nextcloud declined to patch it, treating the issue as outside its own codebase. _Developers tracking dependency patches can follow FFmpeg release updates via daily.dev._ ### Can PixelSmash be used for remote code execution on Jellyfin media servers? Yes, JFrog demonstrated full remote code execution against a Jellyfin 10.11.9 server by exploiting PixelSmash during the automatic ffprobe metadata scan triggered when a crafted MagicYUV AVI file is added to the media library, hijacking AVBuffer.free to call system(). However, RCE requires ASLR to be disabled or chained with a separate FlashSV information-disclosure bug to bypass it; without RCE, the flaw still reliably causes denial-of-service. _Self-hosted server admins evaluating exposure to media-processing exploits can follow such disclosures on daily.dev._ ## Similar posts on daily.dev - [Hole in widely-used FFmpeg codec could crash media servers or enable RCE](https://daily.dev/posts/hole-in-widely-used-ffmpeg-codec-could-crash-media-servers-or-enable-rce-cflqjb7as) · CSO Online · 12 upvotes · 0 comments - [PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons](https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v) · JFrog · 3 upvotes · 0 comments - [AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC](https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa) · InfoQ · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#backend](https://daily.dev/tags/backend), [#jellyfin](https://daily.dev/tags/jellyfin) [View this post on daily.dev](https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"FFmpeg fixes PixelSmash flaw in widely used video decoder","url":"https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5"},"datePublished":"2026-06-22T21:08:52.962Z","dateModified":"2026-09-14T07:22:56.778Z","description":"A heap out-of-bounds write vulnerability (CVE-2026-8461), dubbed 'PixelSmash', has been discovered in FFmpeg's MagicYUV decoder. The flaw affects any...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c42074143cbf23ba1a2485200eb7a63?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c42074143cbf23ba1a2485200eb7a63?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":37},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,backend,jellyfin","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"FFmpeg fixes PixelSmash flaw in widely used video decoder"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5#faq","mainEntity":[{"@type":"Question","name":"What is the PixelSmash vulnerability in FFmpeg and which CVE does it correspond to?","acceptedAnswer":{"@type":"Answer","text":"PixelSmash is a heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder, tracked as CVE-2026-8461 with a severity score of 8.8. It results from an inconsistency between how the frame allocator and decoder compute chroma plane heights, and can be triggered by opening a malicious AVI, MKV, or MOV file or scanning a directory containing one. Teams patching media pipelines can track FFmpeg security fixes like this one on daily.dev."}},{"@type":"Question","name":"Which version of FFmpeg fixes CVE-2026-8461 and when was it released?","acceptedAnswer":{"@type":"Answer","text":"FFmpeg 8.1.2 fixes CVE-2026-8461, released on June 17 after JFrog reported the flaw to the FFmpeg security team on May 13. Jellyfin also updated its bundled FFmpeg build, while PhotoPrism is adding a file format blocklist and Nextcloud declined to patch it, treating the issue as outside its own codebase. Developers tracking dependency patches can follow FFmpeg release updates via daily.dev."}},{"@type":"Question","name":"Can PixelSmash be used for remote code execution on Jellyfin media servers?","acceptedAnswer":{"@type":"Answer","text":"Yes, JFrog demonstrated full remote code execution against a Jellyfin 10.11.9 server by exploiting PixelSmash during the automatic ffprobe metadata scan triggered when a crafted MagicYUV AVI file is added to the media library, hijacking AVBuffer.free to call system(). However, RCE requires ASLR to be disabled or chained with a separate FlashSV information-disclosure bug to bypass it; without RCE, the flaw still reliably causes denial-of-service. Self-hosted server admins evaluating exposure to media-processing exploits can follow such disclosures on daily.dev."}}]} ```