FFmpeg fixes PixelSmash flaw in widely used video decoder

| 2026-06-24 17:23 CRITICAL HIGH VULNERABILITY DISCLOSURE

JSON

Executive Summary

Highlight CTI
AI-generated

A critical vulnerability, PixelSmash, has been discovered in FFmpeg's MagicYUV video decoder, allowing attackers to turn a tiny, malformed video into an attack tool. The vulnerability, tracked as CVE-2026-8461 with a CVSS score of 8.8, affects tens of millions of Linux systems that rely on ffmpegthumbnailer and system libavcodec for thumbnails, potentially triggering denial of service (DoS) or targeted remote code execution (RCE) attacks when a malicious file is present. The vulnerability can be triggered by crafting a specially formatted AVI, MKV, or MOV file, which requires an application using FFmpeg to process untrusted media and have the MagicYUV decoder compiled in. As of now, Jellyfin and Nextcloud servers with at least tens of thousands of active internet-reachable servers are vulnerable, while consumer network attached storage (NAS) and smart TV platforms that use FFmpeg for previews and thumbnails may also be affected due to their widespread deployment.

Technical Mitigations AI-generated

• Update FFmpeg to version 8.1.2 or later, which includes a fix for CVE-2026-8461. • Check if MagicYUV is enabled and disable it or apply patches where possible in affected systems. • Reduce automatic processing of untrusted video by reviewing preview providers and thumbnailers, especially for rarely used formats. • Monitor abnormal crashes of media players, thumbnailers, or media servers, particularly those using FFmpeg.

Technical Observables Login Required

Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

domains (1)


                                                    av•••••.free

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

CVE-2026-8461

Target & Sectors

Global Scope

Incident Timeline

‎2026/06/24

Researchers at JFrog discovered a critical vulnerability, PixelSmash (CVE-2026-8461), in FFmpeg's MagicYUV video decoder that can be exploited for remote code execution on vulnerable media servers.

Click on any entity below to view its context and source!

infrastructure Linux

The researchers found it was enabled by default in upstream FFmpeg and every Linux distribution package they tested up to FFmpeg 9.0.

Malware Bytes

If you run anything that touches video—from a Linux desktop to a Jellyfin or Nextcloud server, or even an AI model that ingests clips—you probably rely on FFmpeg under the hood.

Malware Bytes

It’s hard to put an exact number on how many systems are affected, but it helps to know that: Tens of millions of Linux systems rely on ffmpegthumbnailer and system libavcodec for thumbnails, meaning “just browsing a folder” can trigger the…

Malware Bytes

Users of affected Linux distributions should keep an eye out for FFmpeg updates or security updates from their distro.

Malware Bytes

infrastructure 8.1.2

FFmpeg version 8.1.2, released on June 17, 2026, includes a fix for CVE‑2026‑8461.

Malware Bytes

Apart from FFmpeg releasing version 8.1.2, which fixes the flaw, Jellyfin also updated its bundled FFmpeg version, and PhotoPrism is working to add a file format blocklist to prevent potential exploitation.

BleepingComputer

The developer addressed the issue in version 8.1.2, released on June 17.

BleepingComputer

Tactical Metrics

Metrics

infrastructure

‎Linux

Affected Product

The researchers found it was enabled by default in upstream FFmpeg and every Linux distribution package they tested up to FFmpeg 9.0.

Malware Bytes

If you run anything that touches video—from a Linux desktop to a Jellyfin or Nextcloud server, or even an AI model that ingests clips—you probably rely on FFmpeg under the hood.

Malware Bytes

Users of affected Linux distributions should keep an eye out for FFmpeg updates or security updates from their distro.

Malware Bytes