CVE-2026-8461: FFmpeg MagicYUV Decoder — Remote Code Execution via Video Files (June 2024)

CVE-2026-8461 — FFmpeg MagicYUV Decoder

CVE-2026-8461 is a high-severity vulnerability in FFmpeg’s MagicYUV decoder. It allows remote code execution (RCE) or denial-of-service (DoS) when an attacker supplies a specially crafted video file. No evidence of active exploitation has been reported, but the attack surface is broad due to FFmpeg’s integration in many media applications.

Attack Vector

The flaw is a heap out-of-bounds write triggered during MagicYUV video decoding. An attacker crafts a malicious video file that, when processed by a vulnerable FFmpeg instance, can overwrite memory. If address space layout randomization (ASLR) is disabled or bypassed, this enables arbitrary code execution as the application user. Even with ASLR, reliable DoS is possible, crashing the application or service. No specific IOCs have been published for this vulnerability.

Who Is at Risk

Applications using FFmpeg with MagicYUV decoding are exposed. Confirmed affected products include Jellyfin, Nextcloud, Kodi, Emby, PhotoPrism, and OBS Studio. Media servers (e.g., Jellyfin, Nextcloud) are especially at risk if they automatically process user-uploaded video files. Jellyfin has released an updated FFmpeg build; Nextcloud has not patched, citing the issue lies outside their codebase. Any deployment using unpatched FFmpeg is vulnerable.

Patch & Mitigate

• Patch: Update to the latest FFmpeg release containing the MagicYUV decoder fix (June 2024 or later). Apply vendor-supplied builds where available.
• Workaround: Restrict processing of untrusted video files and disable MagicYUV decoding if possible.
• Detect: Monitor application logs for crashes or abnormal terminations during video processing. Watch for unexpected process spawns or memory corruption errors linked to FFmpeg.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers deliver malicious video files to trigger the vulnerability.
• TA0005 — Defense Evasion: Exploitation may bypass memory protections if ASLR is not enforced.
• TA0009 — Collection: Compromised servers may be used to access or exfiltrate media content.

Source: https://www.bleepingcomputer.com/news/security/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder/