A heap out-of-bounds write in FFmpeg’s MagicYUV decoder (CVE-2026-8461) lets attackers trigger denial-of-service or, if ASLR is disabled or chained with another bug, achieve remote code execution on Jellyfin, Nextcloud and other apps that use libavcodec. The issue affects video files in AVI, MKV and MOV formats and has been fixed in FFmpeg 8.1.2; users should update or block the decoder to stay safe.

• JFrog achieved full RCE on Jellyfin 10.11.9 just by dropping a malicious MagicYUV AVI file into its media library, triggered automatically by ffprobe scanning.
• The bug (CVE-2026-8461, severity 8.8) hits any app using libavcodec with MagicYUV enabled—Kodi, Emby, Nextcloud, PhotoPrism, OBS, GNOME/KDE/XFCE thumbnailers—making it a broad supply-chain risk across hundreds of projects.
• Exploitation requires ASLR to be disabled or chaining with another bug (e.g., an info-leak in FlashSV), but torrent-seeded files into watched folders can trigger it with zero user interaction.
• Fixed in FFmpeg 8.1.2 and adopted by Jellyfin, but Nextcloud isn't patching since its FFmpeg use falls outside core code, and Plex was never at risk due to its stripped-down decoder set.