EXECUTIVE SUMMARY:
CVE-2026-8461 with a CVSS score of 8.8 is a critical heap out-of-bounds write vulnerability in the FFmpeg MagicYUV decoder, affecting versions prior to 8.1.2, which allows an attacker to execute arbitrary code by supplying a crafted video file, specifically leveraging a rounding mismatch within the MagicYUV decoder that fails to calculate chroma plane heights correctly when processing subsampled pixel formats, enabling an attacker with access to the system's media processing pipeline to exploit the vulnerability via a malicious video file, potentially gaining the capability to execute shell commands and run arbitrary payloads on the host system, resulting in significant business impact and consequences, including potential zero-click server compromises and silent heap corruption, particularly in applications that rely on FFmpeg, such as Jellyfin, Nextcloud, and other media servers, and prerequisites for exploitation include the presence of the vulnerable FFmpeg version and the ability to supply a malicious video file to the affected system.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-8461 with a CVSS score of 8.8 is a critical heap out-of-bounds write vulnerability in the FFmpeg MagicYUV decoder, affecting versions prior to 8.1.2, which allows an attacker to execute arbitrary code by supplying a crafted video file, specifically leveraging a rounding mismatch within the MagicYUV decoder that fails to calculate chroma plane heights correctly when processing subsampled pixel formats, enabling an attacker with access to the system's media processing pipeline to exploit the vulnerability via a malicious video file, potentially gaining the capability to execute shell commands and run arbitrary payloads on the host system, resulting in significant business impact and consequences, including potential zero-click server compromises and silent heap corruption, particularly in applications that rely on FFmpeg, such as Jellyfin, Nextcloud, and other media servers, and prerequisites for exploitation include the presence of the vulnerable FFmpeg version and the ability to supply a malicious video file to the affected system.[emaillocker id="1283"]
RECOMMENDATION:
We recommend you to update FFmpeg to version 8.1.2.
REFERENCES:
The following reports contain further technical details:
https://securityonline.info/ffmpeg-magicyuv-vulnerability