Loading story…
FFmpeg patched CVE-2026-8461, a high-severity heap out-of-bounds write flaw dubbed PixelSmash in the libavcodec MagicYUV decoder. The bug is triggered by an odd slice_height condition while parsing malicious AVI, MKV, or MOV files and affects FFmpeg versions before 8.1.2. The vulnerability can cause denial of service and, in some environments, lead to remote code execution.
JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against Jellyfin 10.11.9 via its automated media library scan workflow, although successful RCE required ASLR to be disabled or bypassed. Nextcloud was also identified as potentially vulnerable under additional conditions, while Plex appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to FFmpeg 8.1.2 or later and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
JFrog reported achieving full remote code execution against Nextcloud using CVE-2026-8461 by corrupting FFmpeg heap structures and forcing a call to system() with attacker-controlled input. The report indicates Nextcloud, like Jellyfin, can be exposed through automated media processing workflows.
JFrog said CVE-2026-8461 affects additional applications beyond those previously highlighted, naming Kodi, mpv, Emby, Immich, PhotoPrism, OBS Studio, and ffmpegthumbnailer among confirmed targets. The report described broad exposure across desktop players, media servers, NAS devices, and automated thumbnailing or transcoding workflows.
Following the FFmpeg fix for CVE-2026-8461, Jellyfin updated its bundled FFmpeg. The reporting also noted Plex appeared effectively mitigated through a restricted custom FFmpeg build.
FFmpeg addressed the MagicYUV decoder heap out-of-bounds write vulnerability in version 8.1.2. Guidance in the references recommends updating to FFmpeg 8.1.2 or later to remediate the issue.
JFrog demonstrated full remote code execution against Jellyfin 10.11.9 through its automated media library scan pipeline using CVE-2026-8461. The researchers noted exploitation required ASLR to be disabled or another vulnerability to bypass that protection.
JFrog disclosed CVE-2026-8461, dubbed PixelSmash, a high-severity heap out-of-bounds write in FFmpeg's MagicYUV decoder that can be triggered by malicious AVI, MKV, or MOV files. The flaw affects FFmpeg versions before 8.1.2 and can lead to denial of service and, in some cases, remote code execution.
JFrog disclosed CVE-2026-8461, dubbed PixelSmash, to FFmpeg developers on 2026-05-13. This private report preceded the public disclosure and later fix in FFmpeg 8.1.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcexakep.ru
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcejfrog.com
Open sourcelists.debian.org
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-58049** affects FFmpeg’s RASC video decoder in `libavcodec/rasc.c`, where the `decode_dlta()` function performs 32-bit reads and writes before enforcing a row-boundary check. The flaw is compounded by validating the DLTA region in pixel units rather than byte units, allowing a crafted media stream using the RASC FourCC to access several bytes past a PAL8 frame row allocation. Security advisories say the bug can trigger a bitstream-controlled heap out-of-bounds write and an adjacent out-of-bounds read during decoding, leading to memory corruption and potential remote exploitation. A public proof of concept demonstrates the issue on FFmpeg upstream code and shows how DLTA run handlers can write past a 64-byte PAL8 frame row boundary. The PoC uses a custom buffer callback to place a function pointer next to the frame buffer, then overwrites the low bytes of that pointer through a crafted DLTA run to redirect execution, while AddressSanitizer reports a heap-buffer-overflow in `decode_dlta()`. Reported mitigations include updating FFmpeg, applying vendor patches, and moving row-boundary validation ahead of every 32-bit access with stricter checks such as ensuring `cx + 4 <= w * s->bpp`.
Jun 29, 2026
Jellyfin disclosed **CVE-2026-48793**, a high-severity flaw affecting versions earlier than `10.11.10`, in which subtitle conversion code passes an unescaped subtitle file path into FFmpeg command-line arguments. On Linux, a specially crafted subtitle filename containing double quotes can break argument quoting and inject arbitrary FFmpeg options through `SubtitleEncoder.ConvertTextSubtitleToSrtInternal`, exposing a vulnerability class previously seen in related Jellyfin issues. The vulnerable code path is reachable without authentication through `SubtitleController.GetSubtitle`, and an attacker who can place a file in a Jellyfin media library directory—such as through a shared NAS, Samba share, or guest upload workflow—could trigger **arbitrary file write** on the server and **information disclosure**. The issue carries a CVSS v3.1 score of **8.8**, was reported by Alister MacCormack, and has been fixed in Jellyfin `10.11.10`; administrators are advised to upgrade and restrict untrusted file placement in media library paths.
Jun 29, 2026
WWBN **AVideo** versions up to and including `26.0` are affected by two high-severity flaws that can lead to **remote code execution**. `CVE-2026-33482` is an OS command injection bug in `sanitizeFFmpegCommand()`, which strips some shell metacharacters but fails to remove bash command substitution using `$()`. Because the resulting `ffmpeg` command is later executed in a double-quoted `sh -c` context by `execAsync()`, an attacker able to craft a valid encrypted payload can run arbitrary commands on the standalone encoder server. A separate issue, `CVE-2026-33507`, allows unauthenticated code execution through the plugin import workflow. The `objects/pluginImport.json.php` endpoint permits admin users to upload and install plugin ZIP archives containing executable PHP, but lacks **CSRF** protection; with `session.cookie_samesite = 'None'` on HTTPS connections, an attacker can trick a logged-in administrator into silently importing a malicious plugin and deploying a PHP webshell. Fixes were introduced in commits `25c8ab90269e3a01fb4cf205b40a373487f022e1` and `d1bc1695edd9ad4468a48cea0df6cd943a2635f3`.
Jun 29, 2026