Critical FFmpeg Vulnerability (CVE-2026-8461) Enables Remote Code Execution via Malicious Media Files JFrog Security Research has uncovered a high-severity heap overflow vulnerability in FFmpeg’s MagicYUV decoder, tracked as CVE-2026-8461 (CVSS 8.8), which allows attackers to execute arbitrary code remotely by delivering a single crafted media file no authentication required. The flaw, dubbed PixelSmash, resides in FFmpeg’s `libavcodec` and stems from a rounding mismatch in how the frame allocator and MagicYUV decoder calculate chroma plane heights for subsampled pixel formats like YUV420P. By manipulating a `slice_height` value in a malicious bitstream, attackers can trigger out-of-bounds heap writes, overwriting critical memory structures. Specifically, the exploit targets FFmpeg’s `AVBuffer` struct, replacing a function pointer (`buf->free`) with the address of `system()` and injecting a shell command via `buf->opaque`, turning frame cleanup into an arbitrary command execution vector. JFrog demonstrated full remote code execution (RCE) on two platforms using a 50 KB crafted AVI file: - Jellyfin 10.11.9: Automatically triggered when a malicious file is placed in a monitored library folder, exploiting the media scan pipeline. - Nextcloud: Executes commands as `www-data` when a user browses the Files view, leveraging the Movie preview provider. A particularly high-risk attack vector is the torrent-to-media-library pipeline, where Jellyfin users configure torrent clients to download directly into monitored folders. The exploit requires no user interaction beyond the initial download, as FFmpeg’s real-time filesystem monitor automatically processes the file. As FFmpeg is the most widely deployed media processing framework, the impact is vast. The MagicYUV decoder is enabled by default in upstream FFmpeg builds and major Linux distributions, including Ubuntu, Debian, Fedora, Arch, and Alpine. Confirmed affected applications include: - Media players: mpv, Kodi, OBS Studio - File managers: GNOME, KDE, XFCE (via `ffmpegthumbnailer`) - Media servers: Jellyfin, Emby, Nextcloud, Immich, PhotoPrism - AI/ML pipelines: vLLM (crashed in all tested instances) The exploit works across AVI, MKV, and MOV containers. Only Plex remains unaffected due to its use of a minimal FFmpeg build with `--disable-decoders` and a strict codec allow-list. Mitigation requires upgrading to FFmpeg 9.0 or later. For systems unable to update immediately, workarounds include: - Rebuilding FFmpeg with `--disable-decoder=magicyuv` - Applying a 7-line patch to `libavcodec/magicyuv.c` that enforces `slice_height` validation The FFmpeg and Jellyfin security teams have acknowledged the disclosure and released fixes. Exposure can be checked by running: ```sh ffmpeg -decoders 2>/dev/null | grep magicyuv ``` A vulnerable system will return `VFS..D magicyuv`.

Nextcloud Exposes 367K Records in Unsecured ElasticSearch Cluster In mid-May 2026, security researchers from Cybernews uncovered an unprotected ElasticSearch cluster belonging to European cloud provider Nextcloud, exposing approximately 367,000 records (8GB) of sensitive internal and client data. The exposed archive included employee emails, client company details, contracts, and scripts some stored unencrypted leaving information such as staff email addresses, client names, addresses, and invoice-related communications accessible to anyone with knowledge of the cluster’s location. The majority of the files were PDFs (71,000), followed by PNGs (53,000) and Markdown files (23,000), all housed in a single index. While Nextcloud secured the database within two days of being notified and reported no evidence of unauthorized access, researchers cautioned that malicious actors could have discovered the misconfiguration using automated scanning tools. Nextcloud attributed the incident to a hosting infrastructure misconfiguration, emphasizing that customer servers remained unaffected and that the breach was unrelated to its core cloud platform. The company also notified relevant authorities but acknowledged that a full forensic analysis would be required to confirm whether data was accessed by third parties. The exposed dataset was part of Nextcloud’s internal operations, not its user-hosted services.