Heap out-of-bounds allows remote code execution when decoding a crafted MagicYUV video in FFmpeg

b.s 1
Viewed 2

FFmpeg's MagicYUV decoder in libavcodec contains a heap out-of-bounds write ("PixelSmash", CVE-2026-8461) caused by a mismatch between how frame buffers are allocated and how the decoder computes subsampled chroma-plane heights for video slices. Processing a specially crafted AVI, MKV, or MOV file triggers a one-row heap overflow that can be escalated from a crash to reliable remote code execution. Because FFmpeg's libavcodec is embedded in a huge range of software (media servers, file managers, cloud transcoding pipelines, IoT devices), a single malicious ~50 KB video file can compromise any system that processes it — including automatically, via thumbnail generation, metadata extraction, or library-scan features, without the user ever opening the file.

Steps to reproduce:

  1. Craft an AVI, MKV, or MOV container with a MagicYUV-encoded video stream containing a malformed slice_height value.
  2. Deliver the file to a target that processes it with a vulnerable FFmpeg/libavcodec build — e.g. upload it to a Jellyfin media server (triggers via automatic library scan) or a Nextcloud instance (triggers via the video preview provider).
  3. The decoder's chroma-plane height computation overflows the allocated frame buffer by one row per slice, corrupting adjacent heap memory.
  4. With a crafted overflow payload, this heap corruption is escalated to arbitrary remote code execution on the host.

Workaround: Rebuild FFmpeg with the MagicYUV decoder disabled (--disable-decoder=magicyuv), since it is rarely needed in practice. A minimal 7-line source patch validating slice-height alignment is also available for those who cannot fully upgrade.

Severity: Critical (unauthenticated, no user-interaction-required remote code execution, reachable via automated processing paths like thumbnail/library scans, in a library embedded across a huge swath of widely deployed media software including Jellyfin, mpv, Nextcloud, Immich, OBS, and vLLM)
First seen: 2026-05-13 (reported to FFmpeg security team by JFrog; publicly disclosed 2026-06-22)
Affected product: FFmpeg
Affected platforms: All platforms
Affected versions: FFmpeg versions prior to 8.1.2
Fixed versions: 8.1.2 (released 2026-06-17)

Links:

ffmpeg
1 Answers

Upgrade to FFmpeg 8.1.2 or later, which adds validation to reject malformed slice_height values.

b.s1
Related
Heap out-of-bounds allows remote code execution when decoding a crafted MagicYUV video in FFmpeg
1 solutions