FFmpeg fixes PixelSmash flaw in widely used video decoder
Under some circumstances, a recently discovered FFmpeg vulnerability known as "PixelSmash" might be used to remotely execute code on Jellyfin servers and cause a denial-of-service situation in programs like Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.
The MagicYUV decoder's heap out-of-bounds write vulnerability is known as CVE-2026-8461. It can be exploited by a malicious video file in AVI, MKV, or MOV format and has a high-severity score of 8.8.
Any program that makes use of libavcodec, the fundamental library used by FFmpeg to encode and decode videos, is regarded as susceptible.
However, if the Address Space Layout Randomization (ASLR) defense is turned off or if another vulnerability is chained to circumvent the mitigation, exploitation for remote code execution (RCE) ...