Vulnerabilities & Exploits · Supply Chain

Embedded FFmpeg Decoder Exposes More Than Media Players

A crash in FFmpeg’s MagicYUV decoder is a cross-application code execution path. If a product embeds libavcodec, patching only the visible media app or server can leave the vulnerable decoder in place inside file managers, NAS appliances, preview generators, and transcoding services.

JFrog says CVE-2026-8461 is a heap out-of-bounds write in FFmpeg 8.1.2’s fixed release, and that crafted media can push the bug from denial of service to remote code execution. The issue affects FFmpeg-based software such as OBS Studio and Jellyfin, and the exploit payload can be as small as a 50 KB media file.

The remaining risk is embedded reuse. Any application that auto-opens untrusted media for thumbnails, previews, or transcoding inherits the same RCE path until its bundled FFmpeg is updated.

3 sources · Jun 23

CVE-2026-8461

NVD KEV

CVSS 8.8 HIGH: an out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows… EPSS 2% (73rd percentile).

Timeline

Jun 23 Reported by CSO Online
Jun 22 Reported by BleepingComputer

Sources

Jun 23 CSO Online
Hole in widely-used FFmpeg codec could crash media servers or enable RCE
Research from JFrog into the software supply chain vulnerability points to the need for better visibility into applications, including SBOMs.
original
Jun 23 SecurityWeek
FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances
Attackers can send crafted media files to execute code in any application that uses FFmpeg’s libavcodec library.
original
Jun 22 BleepingComputer
FFmpeg fixes PixelSmash flaw in widely used video decoder
A newly disclosed FFmpeg flaw dubbed 'PixelSmash' could be exploited for remote code execution on Jellyfin servers under certain conditions, and can also trigger a denial-of-service condition in applications like Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.
original

Part of the PlainSec briefing for 2026-06-23

Every edition of this story: Embedded FFmpeg Decoder Exposes More Than Media Players

More from today

Vulnerabilities & Exploits · Supply ChainEmbedded FFmpeg Decoder Exposes More Than Media PlayersA crash in FFmpeg’s MagicYUV decoder is a cross-application code execution path. If a product embeds libavcodec, patching only the visible media app or server can leave the vulnerable decoder in place inside file managers, NAS appliances, preview generators, and transcoding services.JFrog says CVE-2026-8461 is a heap out-of-bounds write in FFmpeg 8.1.2’s fixed release, and that crafted media can push the bug from denial of service to remote code execution. The issue affects FFmpeg-based software such as OBS Studio and Jellyfin, and the exploit payload can be as small as a 50 KB media file.The remaining risk is embedded reuse. Any application that auto-opens untrusted media for thumbnails, previews, or transcoding inherits the same RCE path until its bundled FFmpeg is updated.3 sources · Jun 23

CVE-2026-8461

NVD KEV

CVSS 8.8 HIGH: an out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows… EPSS 2% (73rd percentile).

Timeline

Jun 23 Reported by CSO Online

Jun 22 Reported by BleepingComputer

Sources

Jun 23 CSO Online

Hole in widely-used FFmpeg codec could crash media servers or enable RCE

Research from JFrog into the software supply chain vulnerability points to the need for better visibility into applications, including SBOMs.

original

Jun 23 SecurityWeek

FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances

Attackers can send crafted media files to execute code in any application that uses FFmpeg’s libavcodec library.

original

Jun 22 BleepingComputer

FFmpeg fixes PixelSmash flaw in widely used video decoder

A newly disclosed FFmpeg flaw dubbed 'PixelSmash' could be exploited for remote code execution on Jellyfin servers under certain conditions, and can also trigger a denial-of-service condition in applications like Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.

original

Part of the PlainSec briefing for 2026-06-23Every edition of this story: Embedded FFmpeg Decoder Exposes More Than Media PlayersMore from today

Trusted Plugin Updates Became the Payload

Infected Routers Become a Hidden Scanning Fabric

Gravity SMTP Bug Exposes Mail-Sending Credentials