CVE-2026-8461: FFmpeg MagicYUV Decoder Out-of-Bounds Write (RCE/DoS)

Technical summary

CVE-2026-8461 is an out-of-bounds write vulnerability (CWE-787) in FFmpeg's libavcodec library, specifically within the MagicYUV decoder implementation (libavcodec/magicyuv.C). The flaw permits writing beyond allocated buffer boundaries, which can lead to heap corruption. The attack vector is network-accessible, requires no elevated privileges, and has low attack complexity. However, user interaction is required to trigger the vulnerability—the victim must initiate processing of a malicious MagicYUV-encoded file. This combination of factors creates a pathway for both denial-of-service and, depending on memory layout and exploitation sophistication, remote code execution.

Business impact

Organizations using FFmpeg for video transcoding, streaming, or processing workflows face operational disruption from denial-of-service conditions. Media companies, content platforms, and automated video processing pipelines are at elevated risk. If remote code execution is achieved, attackers gain the ability to run commands with the privileges of the FFmpeg process, potentially leading to data exfiltration, lateral movement, or supply chain compromise if FFmpeg is part of a critical content delivery or encoding chain. The requirement for user interaction somewhat limits mass exploitation, but file-based attacks can still affect automated workflows that process untrusted or user-supplied video content.

Affected systems

FFmpeg versions prior to 8.1.2 are vulnerable. This includes all releases of the 8.0.x, 7.x, and earlier major versions. Any system or application that embeds or depends on an affected FFmpeg build is potentially vulnerable. This includes media players, transcoding servers, content management systems, streaming platforms, and security tools that use FFmpeg for video analysis. The vulnerability does not affect FFmpeg 8.1.2 and later.

Exploitability

Exploitation requires crafting a malicious MagicYUV-encoded video file and delivering it to a user or system that will process it with a vulnerable FFmpeg build. The attack complexity is low once a malicious file is prepared. However, the requirement for user interaction (opening or processing the file) reduces the severity of automated, large-scale attacks. Targeted exploitation of media professionals, content creators, or automated video ingest systems is feasible. There is currently no indication this vulnerability is being actively exploited in the wild, and it does not appear on the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade FFmpeg to version 8.1.2 or later as soon as feasible. Organizations should prioritize patching systems that process video content from untrusted sources or user submissions. For environments where immediate upgrading is not possible, implement network controls to restrict video processing to trusted sources and consider disabling MagicYUV codec support if the feature is not essential to operations.

Patch guidance

Upgrade FFmpeg to version 8.1.2 or later. Verify the patched version by checking the FFmpeg release notes and confirming the version string in your installation. If FFmpeg is bundled within another application or service, check the vendor's advisory for updated versions of that product that incorporate the patched FFmpeg library. Test the patched version in a non-production environment first to ensure compatibility with existing workflows and media assets.

Detection guidance

Monitor for any attempts to process MagicYUV video files in your environment, particularly from external or untrusted sources. Log FFmpeg process invocations, especially those handling user-uploaded or internet-sourced video content. Look for application crashes, segmentation faults, or unexpected terminations of FFmpeg processes or video processing services, which could indicate exploitation attempts. Review system logs for unauthorized code execution following video processing operations. Organizations can also scan for FFmpeg installations and confirm the version number to identify systems still running vulnerable builds.

Why prioritize this

While the CVSS score of 8.8 (HIGH) reflects the severity of potential remote code execution, the actual risk to your organization depends on your video processing architecture. Prioritize patching if you operate automated video ingest systems, user-generated content platforms, or media processing pipelines that consume untrusted video files. Organizations that only process video from fully trusted internal sources can defer patching slightly longer but should still plan updates within a standard patch cycle. The requirement for user interaction provides a slight operational buffer but does not eliminate the risk.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible attack requiring no privileges and low complexity, coupled with high impact across confidentiality, integrity, and availability. The user interaction requirement prevents a score in the 9+ critical range, but the combination of remote code execution potential and widespread FFmpeg deployment justifies the HIGH severity classification.

Frequently asked questions