FFmpeg Fixes PixelSmash Flaw That Can Enable RCE in Jellyfin
Summary
JFrog disclosed PixelSmash (CVE-2026-8461), a high-severity heap out-of-bounds write in FFmpeg’s MagicYUV decoder. Crafted video can cause DoS and, under conditions including disabled or bypassed ASLR, RCE; FFmpeg 8.1.2 fixes it.
Key points
- PixelSmash is a heap out-of-bounds write caused by inconsistent chroma-plane height calculations in FFmpeg’s MagicYUV decoder.
- Crafted AVI, MKV, or MOV files can trigger the flaw when opened, scanned for metadata, or processed for thumbnails.
- JFrog demonstrated RCE against Jellyfin and Nextcloud with Movie preview enabled; RCE requires ASLR to be disabled or bypassed.
- The flaw can also cause denial of service. Multiple FFmpeg-based media applications and thumbnail generators may be affected.
- FFmpeg 8.1.2 fixes the vulnerability; Jellyfin updated its bundled FFmpeg, and PhotoPrism is working on a file-format blocklist.
- Plex’s custom FFmpeg build, with decoders disabled and a minimal allowlist, was found to mitigate the risk.
Article Details
- Vulnerability Types
- Heap out-of-bounds write in the MagicYUV decoder
- Severity
- High (CVSS 8.8)
- Affected Versions
- Jellyfin 10.11.9
- Exploitation Status
- reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationJFrog demonstrated remote code execution against a Jellyfin server by having it process a crafted MagicYUV video during its media-library scan.T1499.004 · Application or System ExploitationThe article reports that a crafted video can reliably cause denial of service in vulnerable applications through the MagicYUV decoder flaw.
CVE
People
Products
Embycode execution on Jellyfin under certain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.FFmpegA newly disclosed FFmpeg flaw called PixelSmash (CVE-2026-8461) can enable remote code execution on Jellyfin under certain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, andJellyfinA newly disclosed FFmpeg flaw called PixelSmash (CVE-2026-8461) can enable remote code execution on Jellyfin under certain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, andKodiremote code execution on Jellyfin under certain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.Nextcloudexecution on Jellyfin under certain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.OBS Studiocertain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.PhotoPrismon Jellyfin under certain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.Plexagainst a Jellyfin 10.11.9 media server – the second-most popular self-hosted media server (after Plex) – through its normal media library scan pipeline,” JFrog says.