Feed›Vulnerability›FFmpeg ‘PixelSmash’ bug triggers code execution on media fil...

VulnerabilityCyber Insider

8.8 — CRITICAL

FFmpeg ‘PixelSmash’ bug triggers code execution on media file open

📅 22 June 2026 at 17:30 UTC📰 Cyber InsiderView original source ↗

A critical vulnerability in FFmpeg, the widely used open-source multimedia framework, can be exploited through a specially crafted video file to achieve remote code execution (RCE). Tracked as CVE-2026-8461 and dubbed “PixelSmash,” the flaw affects FFmpeg's MagicYUV decoder. The vulnerability was discovered by JFrog researcher Yuval Moravchick, who detailed how a seemingly harmless 50 KB … The post FFmpeg ‘PixelSmash’ bug triggers code execution on media file open appeared first on CyberInsider.

🤖 AI BriefingAuto-generated threat analysis

🔍Threat Overview

A critical vulnerability in FFmpeg's MagicYUV decoder allows remote code execution through a specially crafted video file, potentially impacting downstream software that relies on FFmpeg for media processing.

⚙️Technical Details

CVEs

CVE-2026-8461

Affected Systems

FFmpegKodimpvOBS StudioJellyfinEmbyNextcloudImmichPhotoPrismLinux desktop thumbnail generators

Attack Vectors

NETWORK

💥Impact Assessment

Severity: critical

Who Is at Risk

Administrators and developers using FFmpegOrganizations relying on downstream software that inherits the vulnerable code through its dependence on FFmpegSeverity: critical

🛡️Recommended Actions

1Update to the patched version of FFmpeg (8.1.2)

2Disable the MagicYUV decoder in affected systems

3Apply the vendor-provided patch for downstream software that cannot be updated

📦Affected Products

FFmpegKodimpvOBS StudioJellyfinEmbyNextcloudImmichPhotoPrismLinux desktop thumbnail generators

🔐NVD Verified DataVERIFIED

CVE-2026-8461 ↗CVSS 8.8 — HIGH

Attack Vector

NETWORK

Complexity

LOW