PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
JFrog Security Research discovered CVE-2026-8461 (CVSS 8.8), a heap out-of-bounds write in FFmpeg's MagicYUV decoder dubbed PixelSmash. The bug stems from a rounding mismatch between how the frame allocator and decoder compute chroma plane heights for subsampled pixel formats, allowing a crafted 50 KB AVI/MKV/MOV file to write 640 attacker-controlled bytes past the end of a heap buffer. The overflow lands on FFmpeg's AVBuffer struct, whose function pointer (buf->free) can be overwritten with system() to achieve arbitrary command execution when av_buffer_unref fires during frame cleanup. Full RCE was demonstrated against Jellyfin 10.11.9 (via automatic library scan) and Nextcloud (via video preview generation), both with ASLR disabled. Without ASLR bypass, the primitive reliably crashes every tested application including mpv, Kodi, ffmpegthumbnailer, Emby, Immich, PhotoPrism, OBS Studio, and vLLM. Because libavcodec ships the MagicYUV decoder enabled by default in every upstream build, the vulnerability is a supply chain issue affecting hundreds of downstream projects. FFmpeg 8.1.2 contains the fix; workarounds include rebuilding with --disable-decoder=magicyuv or applying a 7-line patch.
