--- title: PixelSmash – Critical FFmpeg Vulnerability Turns Media... description: JFrog Security Research discovered CVE-2026-8461 (CVSS 8.8), a heap out-of-bounds write in FFmpeg's MagicYUV decoder dubbed PixelSmash. The bug stems from a... canonical: https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons | daily.dev og:description: JFrog Security Research discovered CVE-2026-8461 (CVSS 8.8), a heap out-of-bounds write in FFmpeg's MagicYUV decoder dubbed PixelSmash. The bug stems from a... og:url: https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v og:image: https://api.daily.dev/og/posts/pIEOfXy5V.png og:image:alt: PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons **[JFrog](https://daily.dev/sources/jfrog)** · 22 min read · 3 upvotes · 0 comments ## Summary JFrog Security Research discovered CVE-2026-8461 (CVSS 8.8), a heap out-of-bounds write in FFmpeg's MagicYUV decoder dubbed PixelSmash. The bug stems from a rounding mismatch between how the frame allocator and decoder compute chroma plane heights for subsampled pixel formats, allowing a crafted 50 KB AVI/MKV/MOV file to write 640 attacker-controlled bytes past the end of a heap buffer. The overflow lands on FFmpeg's AVBuffer struct, whose function pointer (buf->free) can be overwritten with system() to achieve arbitrary command execution when av_buffer_unref fires during frame cleanup. Full RCE was demonstrated against Jellyfin 10.11.9 (via automatic library scan) and Nextcloud (via video preview generation), both with ASLR disabled. Without ASLR bypass, the primitive reliably crashes every tested application including mpv, Kodi, ffmpegthumbnailer, Emby, Immich, PhotoPrism, OBS Studio, and vLLM. Because libavcodec ships the MagicYUV decoder enabled by default in every upstream build, the vulnerability is a supply chain issue affecting hundreds of downstream projects. FFmpeg 8.1.2 contains the fix; workarounds include rebuilding with --disable-decoder=magicyuv or applying a 7-line patch. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-8461 and which FFmpeg version fixes it? CVE-2026-8461, dubbed PixelSmash, is a heap out-of-bounds write (CVSS 8.8) in FFmpeg's MagicYUV decoder caused by a rounding mismatch between how the frame allocator and decoder compute chroma plane heights when slice_height is odd. FFmpeg released patched version 8.1.2 on June 17, 2026. Before that fix, the MagicYUV decoder was enabled by default in every upstream build and distro package prior to FFmpeg 9.0. _Track critical FFmpeg CVEs like this on daily.dev before an unpatched media pipeline becomes an incident._ ### How can I check if my FFmpeg build is vulnerable to the MagicYUV PixelSmash exploit? Run 'ffmpeg -decoders 2>/dev/null | grep magicyuv' and check if the output shows 'VFS..D magicyuv' - if so, the build is vulnerable to CVE-2026-8461. Workarounds include rebuilding FFmpeg with '--disable-decoder=magicyuv', or applying a 7-line patch to libavcodec/magicyuv.c that rejects malformed slice_height values, until upgrading to FFmpeg 8.1.2 is possible. _daily.dev helps engineers stay ahead of workaround steps like these before official patches land._ ### Which applications are vulnerable to the FFmpeg MagicYUV RCE exploit and how does it spread? Confirmed crash targets include Kodi, mpv, ffmpegthumbnailer (used by GNOME/KDE/XFCE), Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, OBS Studio, and vLLM via PyAV, since all link FFmpeg's libavcodec. Full remote code execution was demonstrated against Jellyfin 10.11.9 (via ffprobe library scans) and Nextcloud (via video preview generation), triggered by uploading a crafted 50 KB AVI, MKV, or MOV file with no authentication required. _Following the blast radius of shared dependencies like FFmpeg matters for anyone auditing self-hosted stacks on daily.dev._ ## Similar posts on daily.dev - [FFmpeg fixes PixelSmash flaw in widely used video decoder](https://daily.dev/posts/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder-3sxhpnzu5) · BleepingComputer · 36 upvotes · 0 comments - [AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC](https://daily.dev/posts/ai-enabled-security-researchers-discover-how-a-crafted-video-can-provide-attackers-access-to-your-pc-oeqkbxafa) · InfoQ · 1 upvotes · 0 comments - [Hole in widely-used FFmpeg codec could crash media servers or enable RCE](https://daily.dev/posts/hole-in-widely-used-ffmpeg-codec-could-crash-media-servers-or-enable-rce-cflqjb7as) · CSO Online · 12 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#backend](https://daily.dev/tags/backend) [View this post on daily.dev](https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons","url":"https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v"},"datePublished":"2026-06-22T13:15:47.631Z","dateModified":"2026-09-14T05:58:00.232Z","description":"JFrog Security Research discovered CVE-2026-8461 (CVSS 8.8), a heap out-of-bounds write in FFmpeg's MagicYUV decoder dubbed PixelSmash. The bug stems from a...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"JFrog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JFrog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b11bf37102384ac9983be701b2cf7cd5","url":"https://daily.dev/sources/jfrog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,backend","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JFrog","item":"https://daily.dev/sources/jfrog"},{"@type":"ListItem","position":3,"name":"PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons-pieofxy5v#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-8461 and which FFmpeg version fixes it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-8461, dubbed PixelSmash, is a heap out-of-bounds write (CVSS 8.8) in FFmpeg's MagicYUV decoder caused by a rounding mismatch between how the frame allocator and decoder compute chroma plane heights when slice_height is odd. FFmpeg released patched version 8.1.2 on June 17, 2026. Before that fix, the MagicYUV decoder was enabled by default in every upstream build and distro package prior to FFmpeg 9.0. Track critical FFmpeg CVEs like this on daily.dev before an unpatched media pipeline becomes an incident."}},{"@type":"Question","name":"How can I check if my FFmpeg build is vulnerable to the MagicYUV PixelSmash exploit?","acceptedAnswer":{"@type":"Answer","text":"Run 'ffmpeg -decoders 2\u003e/dev/null | grep magicyuv' and check if the output shows 'VFS..D magicyuv' - if so, the build is vulnerable to CVE-2026-8461. Workarounds include rebuilding FFmpeg with '--disable-decoder=magicyuv', or applying a 7-line patch to libavcodec/magicyuv.c that rejects malformed slice_height values, until upgrading to FFmpeg 8.1.2 is possible. daily.dev helps engineers stay ahead of workaround steps like these before official patches land."}},{"@type":"Question","name":"Which applications are vulnerable to the FFmpeg MagicYUV RCE exploit and how does it spread?","acceptedAnswer":{"@type":"Answer","text":"Confirmed crash targets include Kodi, mpv, ffmpegthumbnailer (used by GNOME/KDE/XFCE), Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, OBS Studio, and vLLM via PyAV, since all link FFmpeg's libavcodec. Full remote code execution was demonstrated against Jellyfin 10.11.9 (via ffprobe library scans) and Nextcloud (via video preview generation), triggered by uploading a crafted 50 KB AVI, MKV, or MOV file with no authentication required. Following the blast radius of shared dependencies like FFmpeg matters for anyone auditing self-hosted stacks on daily.dev."}}]} ```