Critical FFmpeg Vulnerability Allows Attackers to Weaponize Media Files

A critical vulnerability has been disclosed in FFmpeg’s MagicYUV decoder that allows attackers to weaponize seemingly harmless media files and, in some scenarios, achieve remote code execution (RCE). The flaw, tracked as CVE-2026-8461 and dubbed “PixelSmash,” is a heap out-of-bounds write in FFmpeg’s libavcodec component, with a CVSS score of 8.8 (High). According to the […] The post Critical FFmpeg Vulnerability Allows Attackers to Weaponize Media Files appeared first on Cyber Security News.