CVE-2026-8461 (PixelSmash): Heap Out-of-Bounds Write in FFmpeg libavcodec MagicYUV Decoder
CVE-2026-8461 (PixelSmash) (TL-2026-0906), also tracked as PixelSmash, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-22 and last reviewed 2026-07-19. It has no confirmed attribution, affects FFmpeg FFmpeg (libavcodec, MagicYUV decoder), references 1 CVE (CVE-2026-8461), maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0906
- Threat ID
- TL-2026-0906
- Also known as
- PixelSmash
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-22
- Last reviewed
- 2026-07-19
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- media-and-entertainment, technology, cloud-services, consumer, home-lab-self-hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 32
- Updates
- 2026-07-19 · revalidated 1× · latest source
PixelSmash (CVE-2026-8461) is a heap out-of-bounds write in FFmpeg's MagicYUV decoder (libavcodec/magicyuv.c) caused by an inconsistency between how the frame allocator and the decoder compute chroma plane heights for odd slice_height values. A crafted MagicYUV-encoded video (AVI/MKV/MOV) corrupts heap memory during slice decoding, yielding reliable denial-of-service and, with ASLR disabled or chained with an FFmpeg FlashSV information-disclosure bug, remote code execution. Fixed in FFmpeg 8.1.2.
How CVE-2026-8461 (PixelSmash) works
CVE-2026-8461, dubbed PixelSmash by JFrog Security Research, is a heap out-of-bounds write (CWE-787) in the MagicYUV video decoder of FFmpeg's libavcodec library, located in libavcodec/magicyuv.c. MagicYUV is a fast lossless intermediate codec; FFmpeg decodes its frames as independent rectangular regions called slices that are processed in parallel. The root cause is an inconsistency between how FFmpeg's frame allocator and the MagicYUV decoder compute the height of chroma planes when a stream specifies an odd slice_height. For sub-sampled chroma formats the allocator rounds the chroma plane height one way while the slice-handling code rounds it another, so the decoder writes one row of pixel data past the end of the allocated chroma plane buffer — a one-row heap buffer overflow per affected slice.
The vulnerability is reachable wherever FFmpeg decodes attacker-supplied media, which is an enormous attack surface. JFrog demonstrated proof-of-concept exploitation against the Jellyfin 10.11.9 media server and against Nextcloud (with the Movie/preview generation feature enabled). Across the broader ecosystem the bug affects Kodi, Emby, PhotoPrism, OBS Studio, and the GNOME, KDE and XFCE desktop thumbnail generators, with Slack, Discord, Telegram and WhatsApp identified as likely-but-untested consumers of FFmpeg. Plex was already mitigated because it ships a custom FFmpeg build with unused decoders disabled.
Impact ranges from a reliable crash (denial of service) on every vulnerable application to full remote code execution on Jellyfin and Nextcloud. Reliable RCE requires either that ASLR be disabled on the target, or that the heap overflow be chained with a separate information-disclosure vulnerability in FFmpeg's FlashSV decoder to defeat ASLR by leaking memory addresses. Exploitation vectors include a victim opening a malicious file, a server auto-generating thumbnails or previews when a file lands in a watched directory, automated media-ingestion pipelines, and torrent downloads that drop crafted files into monitored media-library folders. JFrog reported the issue to the FFmpeg security team on 2026-05-13; FFmpeg released version 8.1.2 with the fix on 2026-06-17, and public disclosure followed on 2026-06-22. The flaw was not confirmed exploited in the wild at the time of disclosure.
MITRE ATT&CK techniques used in TL-2026-0906
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1211 Exploitation for Stealth
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Lateral Movement
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Command and Control
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing
Impact
T1485 Data Destruction; T1499 Endpoint Denial of Service
stealth
Resource Development
Affected products and versions in CVE-2026-8461 (PixelSmash)
- FFmpeg — FFmpeg (libavcodec, MagicYUV decoder)
Vulnerable versions: < 8.1.2
Fixed in: 8.1.2 - Jellyfin — Jellyfin Media Server
Vulnerable versions: 10.11.9 (bundled FFmpeg)
Fixed in: release with patched bundled FFmpeg 8.1.2 - Nextcloud — Nextcloud (Movie/preview generation via FFmpeg)
Vulnerable versions: any version using vulnerable FFmpeg for previews
Fixed in: mitigated by updating system FFmpeg to 8.1.2 - Multiple — Kodi, Emby, PhotoPrism, OBS Studio, GNOME/KDE/XFCE thumbnailers
Vulnerable versions: builds using FFmpeg/libavcodec < 8.1.2
Fixed in: builds using FFmpeg/libavcodec >= 8.1.2
Remediation for CVE-2026-8461 (PixelSmash)
Patches
- FFmpeg 8.1.2 (released 2026-06-17) fixes the chroma-plane-height inconsistency in libavcodec/magicyuv.c
- Vendor-bundled FFmpeg updates for Jellyfin and downstream distributions
Immediate actions
- Update FFmpeg / libavcodec to version 8.1.2 or later across all hosts and bundled application builds
- Update Jellyfin to a release shipping the patched bundled FFmpeg (10.11.9 confirmed vulnerable)
- Disable automatic movie/video preview and thumbnail generation on Nextcloud and other media servers until FFmpeg is patched
- Apply file-format blocklists for MagicYUV-bearing containers (AVI/MKV/MOV) where decoding is not required
Workarounds
- Disable the MagicYUV decoder in custom FFmpeg builds
- Disable server-side automatic thumbnail/preview generation
- Reject or quarantine untrusted AVI/MKV/MOV uploads pending patch
Longer-term hardening
- Build FFmpeg with unused decoders disabled (--disable-decoder=magicyuv and other unneeded codecs), as Plex does, to shrink the parsing attack surface
- Run media transcoding/thumbnailing in sandboxed, least-privilege, memory-safe-isolated workers (seccomp, containers, dedicated low-privilege service accounts)
- Keep ASLR enabled and enforce hardened heap allocators to raise the bar from RCE to DoS
- Inventory all software that links or bundles FFmpeg and track its libavcodec version in vulnerability management
CVEs associated with CVE-2026-8461 (PixelSmash)
Weaknesses (CWE) in CVE-2026-8461 (PixelSmash)
CWE-787
Timeline of CVE-2026-8461 (PixelSmash)
- JFrog Security Research (led by Yuval Moravchick) reports the MagicYUV heap out-of-bounds write to the FFmpeg security team.
- JFrog begins coordinated disclosure to downstream maintainers: Jellyfin, mpv, OBS Studio, PhotoPrism, and Immich are notified (through 2026-05-26).
- Jellyfin bumps its bundled jellyfin-ffmpeg to a newer upstream version in response to JFrog's notification.
- JFrog notifies the vLLM security team of a confirmed denial-of-service impact via PyAV bindings.
- JFrog notifies the Kodi Foundation of the vulnerability.
- FFmpeg 8.1.2 released, fixing the chroma-plane-height inconsistency in libavcodec/magicyuv.c (PR #23159 merged into FFmpeg master).
- No confirmed in-the-wild exploitation at time of disclosure; public proof-of-concept available demonstrating DoS and conditional RCE.
- BleepingComputer and other outlets publish coverage of the PixelSmash flaw across the widely-deployed FFmpeg ecosystem (Kodi, Emby, OBS Studio, PhotoPrism, desktop thumbnailers).
- Jellyfin updates its bundled FFmpeg; PhotoPrism works on a file-format blocklist; Nextcloud declines to patch (defect external to Nextcloud, reported via HackerOne); Plex unaffected due to custom FFmpeg build with unused decoders disabled.
- NVD, GHSA-qff7-4q6c-m8h6, and Tenable plugin (issue 222562) published with CVSS 3.1 base 8.8 and CWE-787 classification.
- JFrog demonstrates the end-to-end RCE chain on Jellyfin: a crafted MagicYUV AVI dropped into the media library auto-triggers ffprobe metadata extraction, the OOB write fires, AVBuffer.free is hijacked to system(), and arbitrary commands execute as the jellyfin service user.
- Public disclosure as CVE-2026-8461 / PixelSmash; JFrog publishes analysis and PoC against Jellyfin 10.11.9 and Nextcloud.
- Multiple security blogs and research aggregators (ToolsLib, Penligent, Aviatrix, Xcitium, HackMag) publish secondary analyses summarizing the JFrog findings.
- Ubuntu's security tracker lists CVE-2026-8461 against ffmpeg/libav packages across 18.04-26.04 releases as 'needs evaluation.'
Update history for TL-2026-0906
- 2026-07-19 — PixelSmash (CVE-2026-8461): Critical FFmpeg MagicYUV Decoder Heap Overflow Enables RCE via Crafted Media Files: What changed No severity/exploitability/status escalation — both reports agree HIGH/POC_PUBLIC/ACTIVE with CVSS 8.8. What's new is scope: two additional confirmed RCE/crash targets (Emby, Immich), transitive exposure in Red Hat's AI inferen
Sources cited for CVE-2026-8461 (PixelSmash)
Threats related to CVE-2026-8461 (PixelSmash)
- CISA KEV (2026-05-21): CVE-2025-34291 Langflow CORS Token Hijack-to-RCE & CVE-2026-34926 Trend Micro Apex One On-Premise Directory Traversal
- Notepad++ v8.9.6 — Critical Arbitrary Code Execution via config.xml commandLineInterpreter and shortcuts.xml (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)
- CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)
- Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues)
- QNAP QSA-26-10: Multiple Injection and Memory-Safety Vulnerabilities in QTS, QuTS hero, QuTS cloud, QVP, and File Station (CVE-2025-66273, CVE-2026-26240, and 12 others)
- CVE-2026-54420 — LiteSpeed cPanel Plugin Symlink-Following (CWE-61) Privilege Escalation to Root on CloudLinux/CageFS Shared Hosting; Added to CISA KEV After In-the-Wild Exploitation
Detection coverage for TL-2026-0906
As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0906 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.