Threat video1:00
CVE-2026-8461 FFmpeg MagicYUV RCE: Detection & IOCs
PixelSmash turns a crafted AVI, MKV or MOV file into RCE in Jellyfin 10.11.9 with ASLR off. 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-8461 FFmpeg MagicYUV RCE: Detection & IOCs →
Chapters
- 0:00The hookJFrog Research reproduced about ~640-byte heap overflow.
- 0:05The storyMagicYUV rounding causes heap overflow.
- 0:12Attack pathCrafted MagicYUV file contains malicious slice-height value.
- 0:30AttributionNo threat actor: this was defensive research.
- 0:34Indicators of compromise3 indicators to hunt: 1 path and 2 package names.
- 0:39MITRE ATT&CK techniques7 ATT&CK techniques, from resource development to impact.
- 0:44Remediation3 steps now: Identify vulnerable builds.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00JFrog Research reproduced about ~640-byte heap overflow.
0:06MagicYUV rounding causes heap overflow.
0:09Videos spawn shell via pointer hijack.
0:12Crafted MagicYUV file contains malicious slice-height value.
0:17Decoder processes file and triggers out-of-bounds write.
0:21Overflow corrupts AVBuffer and hijacks the function pointer.
0:25Shell spawns and executes commands before the crash.
0:30No threat actor: this was defensive research.
0:343 indicators to hunt: 1 path and 2 package names.
0:407 ATT&CK techniques, from resource development to impact.
0:443 steps now: Identify vulnerable builds.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.