Embedded FFmpeg Decoder Exposes More Than Media Players
A crash in FFmpeg’s MagicYUV decoder is a cross-application code execution path. If a product embeds libavcodec, patching only the visible media app or server can leave the vulnerable decoder in place inside file managers, NAS appliances, preview generators, and transcoding services.
JFrog says CVE-2026-8461 is a heap out-of-bounds write in FFmpeg 8.1.2’s fixed release, and that crafted media can push the bug from denial of service to remote code execution. The issue affects FFmpeg-based software such as OBS Studio and Jellyfin, and the exploit payload can be as small as a 50 KB media file.
The remaining risk is embedded reuse. Any application that auto-opens untrusted media for thumbnails, previews, or transcoding inherits the same RCE path until its bundled FFmpeg is updated.