Critical FFmpeg Vulnerability Allows Attackers to Weaponize Media Files

A critical FFmpeg vulnerability (CVE-2026-8461, "PixelSmash") in the MagicYUV decoder allows crafted AVI/MKV/MOV files to trigger heap out-of-bounds writes that can crash applications or, with a refined exploit chain, achieve remote code execution; JFrog demonstrated PoC RCE against Jellyfin and Nextcloud using a small malicious file. Because MagicYUV is enabled by default in many FFmpeg builds and is widely embedded (thumbnailers, media servers, cloud/AI pipelines), the flaw presents a near-zero-click, broad supply-chain risk — upgrade to patched FFmpeg (e.g., 8.1.2+) or disable the MagicYUV decoder/apply bounds checks as mitigations.