Disclosure: I work at JFrog, which discovered this vulnerability - just sharing the info below. TL;DR: A heap out-of-bounds write in FFmpeg's MagicYUV decoder (CVSS 8.8), the world’s most ubiquitous open-source multimedia framework that processes and streams over 90% of all video and audio content on the internet.     The discovered vulnerability is capable of performing Remote Code Execution (RCE) to crash any application that uses FFmpeg by delivering a single 50 KB media file. This isn't a theoretical bug. Researchers demonstrated full RCE against Jellyfin (triggered by automatic library scan – no user interaction) and Nextcloud (triggered by a file appearing in a folder listing). Crashes were confirmed across mpv, Kodi, OBS, Immich, vLLM, and more. A patched version is available.

What is it? CVE-2026-8461, named PixelSmash, is a vulnerability in libavcodec, the codec library bundled inside FFmpeg. Specifically, it's in the MagicYUV decoder — a lossless video codec decoder that ships enabled by default in every upstream FFmpeg build.

The bug is a heap out-of-bounds write. When FFmpeg decodes a crafted MagicYUV video, it calculates the wrong buffer size for chroma (color) plane data and writes one full row past the end of the allocated heap buffer. With a carefully crafted file, that overflow lands on an internal FFmpeg control structure (AVBuffer), which contains a function pointer. Overwriting that pointer with the address of system() and a shell command string converts normal frame cleanup into arbitrary command execution. The exploit file is 50 KB and works in AVI, MKV, and MOV containers.

How does the attack work? CVE-2026-8461 is a heap out-of-bounds write. When FFmpeg decodes a crafted MagicYUV video, it calculates the wrong buffer size for chroma (color) plane data and writes one full row past the end of the allocated heap buffer. With a carefully crafted file, that overflow lands on an internal FFmpeg control structure (\AVBuffer\), which contains a function pointer. Overwriting that pointer with the address of \system()\ and a shell command string converts normal frame cleanup into arbitrary command execution. The exploit file is 50 KB and works in AVI, MKV, and MOV containers.