Critical FFmpeg Vulnerability (CVE-2026-8461) Enables Remote Code Execution via Malicious Media Files JFrog Security Research has uncovered a high-severity heap overflow vulnerability in FFmpeg’s MagicYUV decoder, tracked as CVE-2026-8461 (CVSS 8.8), which allows attackers to execute arbitrary code remotely by delivering a single crafted media file no authentication required. The flaw, dubbed PixelSmash, resides in FFmpeg’s `libavcodec` and stems from a rounding mismatch in how the frame allocator and MagicYUV decoder calculate chroma plane heights for subsampled pixel formats like YUV420P. By manipulating a `slice_height` value in a malicious bitstream, attackers can trigger out-of-bounds heap writes, overwriting critical memory structures. Specifically, the exploit targets FFmpeg’s `AVBuffer` struct, replacing a function pointer (`buf->free`) with the address of `system()` and injecting a shell command via `buf->opaque`, turning frame cleanup into an arbitrary command execution vector. JFrog demonstrated full remote code execution (RCE) on two platforms using a 50 KB crafted AVI file: - Jellyfin 10.11.9: Automatically triggered when a malicious file is placed in a monitored library folder, exploiting the media scan pipeline. - Nextcloud: Executes commands as `www-data` when a user browses the Files view, leveraging the Movie preview provider. A particularly high-risk attack vector is the torrent-to-media-library pipeline, where Jellyfin users configure torrent clients to download directly into monitored folders. The exploit requires no user interaction beyond the initial download, as FFmpeg’s real-time filesystem monitor automatically processes the file. As FFmpeg is the most widely deployed media processing framework, the impact is vast. The MagicYUV decoder is enabled by default in upstream FFmpeg builds and major Linux distributions, including Ubuntu, Debian, Fedora, Arch, and Alpine. Confirmed affected applications include: - Media players: mpv, Kodi, OBS Studio - File managers: GNOME, KDE, XFCE (via `ffmpegthumbnailer`) - Media servers: Jellyfin, Emby, Nextcloud, Immich, PhotoPrism - AI/ML pipelines: vLLM (crashed in all tested instances) The exploit works across AVI, MKV, and MOV containers. Only Plex remains unaffected due to its use of a minimal FFmpeg build with `--disable-decoders` and a strict codec allow-list. Mitigation requires upgrading to FFmpeg 9.0 or later. For systems unable to update immediately, workarounds include: - Rebuilding FFmpeg with `--disable-decoder=magicyuv` - Applying a 7-line patch to `libavcodec/magicyuv.c` that enforces `slice_height` validation The FFmpeg and Jellyfin security teams have acknowledged the disclosure and released fixes. Exposure can be checked by running: ```sh ffmpeg -decoders 2>/dev/null | grep magicyuv ``` A vulnerable system will return `VFS..D magicyuv`.