cyberinsider.com • 6w
FFmpeg: Critical "PixelSmash" Vulnerability CVE-2026-8461 Enables Remote Code Execution
CVE-2026-8461, dubbed "PixelSmash," is a critical heap out-of-bounds write vulnerability residing in the MagicYUV decoder of FFmpeg's libavcodec library. An attacker can achieve Remote Code Execution (RCE) by delivering a specially crafted media file (AVI, MKV, or MOV) approximately 50 KB in size, which allows for the overwriting of function pointers. The vulnerability is particularly hazardous as it can be triggered passively via automatic thumbnail generation or library scanning in media servers and cloud transcoding pipelines. Successful exploitation has been demonstrated on Jellyfin and Nextcloud. Remediation requires upgrading to FFmpeg version 8.1.2 or disabling the MagicYUV decoder during the build process.