# CVE-2026-8461 (PixelSmash): Heap Out-of-Bounds Write in FFmpeg libavcodec MagicYUV Decoder

> PixelSmash (CVE-2026-8461) is a heap out-of-bounds write in FFmpeg's MagicYUV decoder (libavcodec/magicyuv.c) caused by an inconsistency between how the frame allocator and the decoder compute chroma plane heights for odd slice_height values. A crafted MagicYUV-encoded video (AVI/MKV/MOV) corrupts heap memory during slice decoding, yielding reliable denial-of-service and, with ASLR disabled or chained with an FFmpeg FlashSV information-disclosure bug, remote code execution. Fixed in FFmpeg 8.1.2.

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-07-19T16:58:20.241Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0906
- **ID:** TL-2026-0906
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8461

## Description

CVE-2026-8461, dubbed PixelSmash by JFrog Security Research, is a heap out-of-bounds write (CWE-787) in the MagicYUV video decoder of FFmpeg's libavcodec library, located in libavcodec/magicyuv.c. MagicYUV is a fast lossless intermediate codec; FFmpeg decodes its frames as independent rectangular regions called slices that are processed in parallel. The root cause is an inconsistency between how FFmpeg's frame allocator and the MagicYUV decoder compute the height of chroma planes when a stream specifies an odd slice_height. For sub-sampled chroma formats the allocator rounds the chroma plane height one way while the slice-handling code rounds it another, so the decoder writes one row of pixel data past the end of the allocated chroma plane buffer — a one-row heap buffer overflow per affected slice.

The vulnerability is reachable wherever FFmpeg decodes attacker-supplied media, which is an enormous attack surface. JFrog demonstrated proof-of-concept exploitation against the Jellyfin 10.11.9 media server and against Nextcloud (with the Movie/preview generation feature enabled). Across the broader ecosystem the bug affects Kodi, Emby, PhotoPrism, OBS Studio, and the GNOME, KDE and XFCE desktop thumbnail generators, with Slack, Discord, Telegram and WhatsApp identified as likely-but-untested consumers of FFmpeg. Plex was already mitigated because it ships a custom FFmpeg build with unused decoders disabled.

Impact ranges from a reliable crash (denial of service) on every vulnerable application to full remote code execution on Jellyfin and Nextcloud. Reliable RCE requires either that ASLR be disabled on the target, or that the heap overflow be chained with a separate information-disclosure vulnerability in FFmpeg's FlashSV decoder to defeat ASLR by leaking memory addresses. Exploitation vectors include a victim opening a malicious file, a server auto-generating thumbnails or previews when a file lands in a watched directory, automated media-ingestion pipelines, and torrent downloads that drop crafted files into monitored media-library folders. JFrog reported the issue to the FFmpeg security team on 2026-05-13; FFmpeg released version 8.1.2 with the fix on 2026-06-17, and public disclosure followed on 2026-06-22. The flaw was not confirmed exploited in the wild at the time of disclosure.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1574 Hijack Execution Flow
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1082 System Information Discovery
- T1080 Taint Shared Content
- T1105 Ingress Tool Transfer
- T1499 Endpoint Denial of Service
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1518 Software Discovery
- T1485 Data Destruction
- T1588 Obtain Capabilities
- T1005 Data from Local System

## Sources

- [FFmpeg fixes PixelSmash flaw in widely-used video decoder](https://www.bleepingcomputer.com/news/security/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder/)
- [NVD - CVE-2026-8461](https://nvd.nist.gov/vuln/detail/CVE-2026-8461)
- [GHSA-qff7-4q6c-m8h6 (Vulnerability-Lookup / CIRCL)](https://vulnerability.circl.lu/vuln/ghsa-qff7-4q6c-m8h6)
- [FFmpeg < 8.1.2 Out-of-Bounds Write (CVE-2026-8461) - Tenable](https://www.tenable.com/plugins/pipeline/issues/222562)
- [FFmpeg Pull Request #23159 (MagicYUV decoder fix)](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159)
- [FFmpeg Security Advisories](https://ffmpeg.org/security.html)
- [JFrog Security Research Blog](https://jfrog.com/blog/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0906