FFmpeg fixes PixelSmash flaw in widely used video decoder
Short summary
A heap out-of-bounds write in FFmpeg’s MagicYUV decoder (CVE-2026-8461) lets attackers trigger denial-of-service or, if ASLR is disabled or chained with another bug, achieve remote code execution on Jellyfin, Nextcloud and other apps that use libavcodec. The issue affects video files in AVI, MKV and MOV formats and has been fixed in FFmpeg 8.1.2; users should update or block the decoder to stay safe.
- JFrog achieved full RCE on Jellyfin 10.11.9 just by dropping a malicious MagicYUV AVI file into its media library, triggered automatically by ffprobe scanning.
- The bug (CVE-2026-8461, severity 8.8) hits any app using libavcodec with MagicYUV enabled—Kodi, Emby, Nextcloud, PhotoPrism, OBS, GNOME/KDE/XFCE thumbnailers—making it a broad supply-chain risk across hundreds of projects.
- Exploitation requires ASLR to be disabled or chaining with another bug (e.g., an info-leak in FlashSV), but torrent-seeded files into watched folders can trigger it with zero user interaction.
- Fixed in FFmpeg 8.1.2 and adopted by Jellyfin, but Nextcloud isn't patching since its FFmpeg use falls outside core code, and Plex was never at risk due to its stripped-down decoder set.
Full summary
A heap out-of-bounds write in FFmpeg’s MagicYUV decoder—tracked as CVE-2026-8461 and nicknamed PixelSmash—can be triggered by a malicious AVI, MKV, or MOV file. With a high severity score of 8.8, the flaw lets attackers hijack AVBuffer.free to run system() calls if ASLR is disabled or another bug is chained. In practice, JFrog researchers achieved full remote code execution on Jellyfin 10.11.9 by dropping a crafted MagicYUV AVI into its media library. Jellyfin’s ffprobe scan automatically processes the file, triggers the overflow, and spawns a reverse shell as the service user.
Beyond direct RCE, any application using libavcodec with MagicYUV enabled—Kodi, Emby, Nextcloud, PhotoPrism, OBS Studio, plus thumbnail generators in GNOME, KDE, XFCE—is vulnerable to at least a reliable denial-of-service. Even Slack, Discord, Telegram, and WhatsApp previews could be at risk, though they weren’t tested. Plex avoids the issue by shipping a hardened FFmpeg build with most decoders disabled. JFrog warns that the decoder appears in hundreds of projects, turning this into a significant supply-chain risk.
FFmpeg 8.1.2 fixes PixelSmash, and Jellyfin has bumped its bundled FFmpeg. PhotoPrism plans a file-format blocklist. Nextcloud opted not to patch—its use of FFmpeg lies outside the core codebase. Researchers also point out that chaining this bug with an information-leak in the FlashSV decoder could bypass ASLR. Meanwhile, torrent-based attacks need no user interaction: a seeded malicious video into a watched folder triggers the same ffprobe pipeline on Jellyfin, firing the overflow and grabbing a shell.