Critical FFmpeg Vulnerability Enables Remote Code Execution via Malicious Media Files

A critical vulnerability in FFmpeg's MagicYUV decoder, tracked as CVE-2026-8461, allows attackers to exploit heap out-of-bounds writes to crash systems or execute remote code. Discovered by JFrog, the flaw affects a wide range of applications that utilize FFmpeg, including media servers like Jellyfin and Nextcloud, as well as desktop applications such as Kodi and VLC. Users can be compromised simply by processing malicious media files, including during thumbnail generation by file managers. The vulnerability has a CVSS score of 8.8, indicating high severity, and a patch (version 8.1.2) has been released. Exploitation requires no special privileges, making it particularly dangerous. Security teams are urged to upgrade immediately to mitigate risks. The potential impact is extensive due to FFmpeg's widespread use across various platforms and devices.

Key Points: • CVE-2026-8461 allows remote code execution via malicious media files. • The vulnerability affects numerous applications, including Jellyfin, Kodi, and VLC. • Users are urged to upgrade to FFmpeg version 8.1.2 to mitigate risks.