Critical FFmpeg Vulnerability Lets Hackers Execute Remote Code via Malicious Media Files

Gbhackers •Divya • June 23, 2026

A critical memory corruption vulnerability in FFmpeg has been disclosed, allowing for remote code execution through specially crafted media files. This flaw, tracked as CVE-2026-8461 and named “PixelSmash,” affects the MagicYUV decoder within FFmpeg’s libavcodec library and has a CVSS score of 8.8. Discovered by JFrog Security Research, the vulnerability arises from a heap out-of-bounds […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FFmpeg Vulnerability Enables Remote Code Execution via Malicious Media Files A critical vulnerability in FFmpeg's MagicYUV decoder, tracked as CVE-2026-8461, allows attackers to exploit heap out-of-bounds writes to crash systems or execute remote code. Discovered by JFrog, the flaw affects a wide range of applications that utilize FFmpeg, including media servers like Jellyfin and Nextcloud, as well as desktop applications such as Kodi and VLC. Users can be compromised simply by processing malicious media files, including during thumbnail generation by file managers. The vulnerability has a CVSS score of 8.8, indicating high severity, and a patch (version 8.1.2) has been released. Exploitation requires no special privileges, making it particularly dangerous. Security teams are urged to upgrade immediately to mitigate risks. The potential impact is extensive due to FFmpeg's widespread use across various platforms and devices. 9 sources 73

Extracted Entities

Critical FFmpeg Vulnerability Lets Hackers Execute Remote Code via Malicious Media Files

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)

Vulnerabilities (1)