AI-Assisted Security Researchers Uncover PixelSmash: Critical FFmpeg Vulnerability Allows RCE via Crafted Videos

JFrog's security research team revealed PixelSmash, a serious flaw in the FFmpeg multimedia framework that remained in the codebase for sixteen years. The vulnerability, assigned CVE-2026-8461 by CISA with a CVSS score of 8.8 (high severity), leads to a stack out-of-bounds write in the MagicYUV decoder, which can crash any application using FFmpeg. Attackers only need to send a specially crafted multimedia file (AVI, MKV, or MOV containers) to execute arbitrary code or cause denial-of-service. The broad usage of the MagicYUV codec amplifies the impact, affecting desktop video players like Kodi and mpv, Linux file manager thumbnail generators, cloud transcoding pipelines, and self-hosted media servers. Researchers demonstrated full exploitation on two targets: Jellyfin media server (via automatic library scanning) and Nextcloud instance (via video preview provider), both by uploading a 50 KB AVI file. No authentication, special privileges, or prior access is required, making it part of the default attack surface for media processing applications. The vulnerability affects systems with MagicYUV decoder enabled, which is default in FFmpeg versions before 9.0 across common distributions. Mitigation includes upgrading, rebuilding FFmpeg without the decoder, or applying a short patch. The incident highlights supply chain fragility and renewed concerns about memory-safe alternatives.