FFmpeg's 16-Year-Old MagicYUV Flaw Enables RCE via Crafted Video
A 16-year-old heap overflow in FFmpeg's MagicYUV decoder (CVE-2026-8461) enables RCE via crafted AVI files, hitting Jellyfin, Nextcloud and more.
JFrog Security Research disclosed PixelSmash, a critical heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder, tracked as CVE-2026-8461 (CVSS 8.8). The bug has sat undetected in the codebase for 16 years despite extensive automated testing, and was surfaced using AI-assisted security research tooling that is increasingly finding its way into vulnerability discovery workflows.
Because FFmpeg's libavcodec underlies desktop video players, Linux file-manager thumbnail generators, cloud transcoding pipelines, and self-hosted media servers, the flaw's blast radius is unusually wide. Researchers demonstrated full remote code execution against Jellyfin and Nextcloud simply by uploading a 50KB crafted AVI file, requiring no authentication or elevated privileges.
Mitigations include upgrading to patched FFmpeg builds, disabling the MagicYUV decoder at compile time, or applying a small source-level patch that rejects malformed slice-height values. The disclosure has reignited debate over the risks of relying on legacy, memory-unsafe C codebases for performance-critical infrastructure components.
This synthesis was produced from its source by AI; there is no human editor or manual review step. How we work