🎬 CVE-2026-8461 — PixelSmash

Critical Out-of-Bounds Write in FFmpeg MagicYUV Decoder

A malicious video file can become a weapon.

PixelSmash is a critical memory corruption vulnerability affecting FFmpeg's MagicYUV decoder that allows an attacker to trigger an out-of-bounds write, resulting in application crashes and potentially remote code execution.

---

📖 Overview

CVE-2026-8461 is a High Severity vulnerability discovered in FFmpeg's libavcodec MagicYUV decoder.

The vulnerability is caused by improper bounds validation during frame decoding, allowing specially crafted media files to write beyond allocated memory.

Applications that automatically process uploaded or downloaded videos may become vulnerable without requiring user interaction.

⚡ Vulnerability Information

🧠 Root Cause

The MagicYUV decoder fails to correctly validate certain dimensions and memory boundaries while decoding specially crafted frames.

This enables writes outside the intended heap buffer, corrupting adjacent memory structures.

Memory corruption may lead to:

• Process crash
• Heap corruption
• Denial of Service
• Potential Remote Code Execution

💥 Attack Scenario

Attacker
    │
    │ Uploads malicious MagicYUV video
    ▼
Media Server / Desktop Application
    │
    │ FFmpeg parses file
    ▼
MagicYUV Decoder
    │
    │ Out-of-Bounds Write
    ▼
Memory Corruption
    │
    ├── Application Crash
    ├── Service Disruption
    └── Potential Remote Code Execution

🎯 Potentially Affected Software

Applications embedding FFmpeg may be affected, including:

• Jellyfin
• Nextcloud
• mpv
• Kodi
• OBS Studio
• ffmpegthumbnailer
• Media indexing services
• Video conversion pipelines
• Automated thumbnail generators

🔥 Possible Impacts

• 💣 Application crash
• 💣 Heap corruption
• 💣 Denial of Service
• 💣 Remote Code Execution (under specific conditions)
• 💣 Compromise of media processing servers
• 💣 Malicious uploads targeting automated workflows

🛡️ Mitigation

✅ Upgrade to FFmpeg 8.1.2 or later

✅ Reject untrusted uploads

✅ Sandbox media processing

✅ Isolate transcoding services

✅ Disable automatic preview generation for untrusted content when possible

✅ Apply vendor security updates promptly

🔍 Detection

Security teams should monitor for:

• Unexpected FFmpeg crashes
• Segmentation faults
• Heap corruption reports
• Suspicious MagicYUV media uploads
• Repeated decoding failures
• Automated thumbnail generation failures

📊 Risk Assessment

📦 Fixed Version

📚 References

• NVD Advisory
• FFmpeg Security Advisory
• JFrog Security Research (PixelSmash)