PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons

JFrog Security Research disclosed a critical vulnerability named PixelSmash (CVE-2026-8461) in FFmpeg's MagicYUV decoder, which poses a high risk of remote code execution through a heap out-of-bounds write when processing malicious media files. This vulnerability affects numerous applications across various platforms that rely on FFmpeg for media processing, including video players, media servers, and cloud transcoding services, among others. PixelSmash can be exploited by simply uploading a crafted media file, leading to crashes or remote code execution, as demonstrated against targets like Jellyfin and Nextcloud. The vulnerability underscores the widespread impact of software supply chain vulnerabilities, as FFmpeg's default builds include the MagicYUV decoder, which many downstream applications inherit without explicit opt-in, making them susceptible to exploitation. Users are advised to upgrade to the fixed version of FFmpeg or apply workarounds to disable the vulnerable decoder to mitigate the risk.