FFmpeg fixed a newly disclosed bug that can crash or potentially compromise apps and servers that process malicious video files. The flaw, CVE-2026-8461, is a heap out-of-bounds write in FFmpeg's MagicYUV decoder affecting libavcodec users; JFrog showed remote code execution on Jellyfin 10.11.9 and Nextcloud setups with movie previews enabled, while other apps including Kodi, Emby, PhotoPrism, OBS Studio, and desktop thumbnailers may be vulnerable to denial of service. FFmpeg 8.1.2 contains the fix.
Why it matters: Organizations and self-hosting users that automatically scan or preview uploaded media should treat this as urgent because a booby-trapped video can trigger processing without being played. Update FFmpeg and any bundled copies in products like Jellyfin, and review whether automated media preview or ingestion workflows expose internet-facing systems.
Ionut Arghire
2026.06.23
97% relevant
This article is a fuller write-up of the same PixelSmash event, adding exploitation details, affected application examples such as Kodi, mpv, Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, and OBS Studio, and clarifying near-zero-click and zero-click delivery paths through thumbnailing, media scanning, and upload processing.
Bill Toulas
2026.06.22
100% relevant
This article appears to be the first tracked item establishing the PixelSmash / CVE-2026-8461 event: a newly disclosed FFmpeg decoder flaw, proof-of-concept impact on major downstream apps, and release of the upstream fix.
← Back to all stories