Executive Summary
JFrog Security Research has disclosed a critical vulnerability, dubbed PixelSmash (CVE-2026-8461), affecting the FFmpeg media processing framework. The flaw is a heap out-of-bounds write within the MagicYUV decoder, which can be leveraged to achieve reliable remote code execution (RCE) on systems processing malicious AVI, MKV, or MOV files. Successful exploitation has been demonstrated against Jellyfin media servers and Nextcloud instances through automated library scans and preview generation.
Technically, the vulnerability stems from a rounding mismatch in how chroma plane heights are computed for subsampled pixel formats, leading to a one-row heap buffer overflow. Attackers can overwrite the AVBuffer struct to hijack function pointers and execute arbitrary shell commands. Because libavcodec is a foundational dependency for hundreds of desktop players, server-side media stacks, and even AI/ML pipelines like vLLM, the supply chain impact is extensive.
This is a high-urgency issue as exploitation can occur with zero user interaction in many common configurations, such as automated torrent downloads into monitored media folders. Organizations should prioritize updating FFmpeg to version 9.0 or higher, or rebuild their builds with the MagicYUV decoder disabled.