Critical FFmpeg Vulnerability Allows Attackers to Weaponize Media Files

Cybersecuritynews •Abinaya • June 23, 2026

A critical vulnerability has been disclosed in FFmpeg’s MagicYUV decoder that allows attackers to weaponize seemingly harmless media files and, in some scenarios, achieve remote code execution (RCE). The flaw, tracked as CVE-2026-8461 and dubbed “PixelSmash,” is a heap out-of-bounds write in FFmpeg’s libavcodec component, with a CVSS score of 8.8 (High). According to the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FFmpeg Vulnerability Enables Remote Code Execution via Malicious Media Files A critical vulnerability in FFmpeg's MagicYUV decoder, tracked as CVE-2026-8461, allows attackers to exploit heap out-of-bounds writes to crash systems or execute remote code. Discovered by JFrog, the flaw affects a wide range of applications that utilize FFmpeg, including media servers like Jellyfin and Nextcloud, as well as desktop applications such as Kodi and VLC. Users can be compromised simply by processing malicious media files, including during thumbnail generation by file managers. The vulnerability has a CVSS score of 8.8, indicating high severity, and a patch (version 8.1.2) has been released. Exploitation requires no special privileges, making it particularly dangerous. Security teams are urged to upgrade immediately to mitigate risks. The potential impact is extensive due to FFmpeg's widespread use across various platforms and devices. 9 sources 73

Extracted Entities

Critical FFmpeg Vulnerability Allows Attackers to Weaponize Media Files

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Tools (1)

Vulnerabilities (1)