Cybersecurity
16-Year-Old FFmpeg Bug Lets Attackers Execute Code via Malicious Video Files
Security researchers discovered PixelSmash, a critical vulnerability in FFmpeg's MagicYUV decoder that persisted undetected for over a decade and can be exploited by uploading a crafted media file.
InfoQ
JFrog Security Research has exposed a severe vulnerability in FFmpeg's widely-used media framework that enables remote code execution through specially crafted video files. The flaw, dubbed PixelSmash, has remained dormant within the codebase since around 2010 despite extensive automated testing. Discovery of such a long-standing bug underscores how AI-driven security research is now uncovering vulnerabilities that traditional methods missed for years.
The Vulnerability#
The defect resides in FFmpeg's MagicYUV decoder and manifests as a heap out-of-bounds write operation. Catalogued as CVE-2026-8461 with a CVSS score of 8.8, this flaw allows attackers to either execute arbitrary code on a target system or cause it to crash. The bug can be triggered by uploading a file as small as 50 kilobytes in AVI, MKV, or MOV format.
Security researchers validated the exploit against two real-world targets: a Jellyfin media server (through an automatic library scan) and a Nextcloud instance (via video preview generation). In both cases, simply uploading the malicious file initiated the attack.
Attack Surface and Affected Systems#
The vulnerability affects any application that decodes video using FFmpeg's libavcodec library—a component installed on millions of devices. The blast radius spans:
- Desktop systems: video players and file managers that generate thumbnails
- Servers: media platforms (Jellyfin, Emby, Nextcloud, Immich), chat services (Slack, Discord, Telegram), and transcoding infrastructure (AWS MediaConvert, Cloudflare Stream)
- Embedded and IoT devices: NAS appliances (Synology, QNAP), smart TVs, and media equipment
No authentication or elevated privileges are needed—an attacker simply needs to deliver the crafted file to a vulnerable application.
Checking and Fixing#
The MagicYUV decoder comes enabled by default in FFmpeg distributions (Ubuntu, Debian, Fedora, Arch, Alpine versions before 9.0). To determine exposure, users can run:
ffmpeg -decoders 2>/dev/null | grep magicyuv
If output shows VFS..D magicyuv, the system is vulnerable. Remediation options include:
