Critical FFmpeg Vulnerability "PixelSmash" Allows Remote Code Execution via Crafted Video Files

Discovery of PixelSmash Vulnerability

JFrog Security Research recently uncovered "PixelSmash," a critical vulnerability within the FFmpeg media framework. This flaw, identified as CVE-2026-8461 with a CVSS score of 8.8 (High), has been present in the codebase for sixteen years. It allows for Remote Code Execution (RCE) and Denial of Service (DoS) attacks, enabling an attacker to execute arbitrary code or crash applications by providing a specially crafted media file.

Technical Details and Exploitation

The vulnerability is a heap out-of-bounds write in the MagicYUV decoder, which is enabled by default in FFmpeg. To exploit PixelSmash, an attacker needs to deliver a crafted media file (such as AVI, MKV, or MOV) to any application that decodes video using FFmpeg’s libavcodec. This can occur if a user opens a malicious file, a file manager generates a thumbnail, or a server processes an uploaded file. No authentication or special privileges are required beyond the ability to deliver the media file.

Widespread Impact Across Systems

The ubiquitous nature of the FFmpeg codec family amplifies the potential impact of this vulnerability. Affected applications include desktop video players like Kodi and mpv, Linux file-manager thumbnail generators, cloud transcoding pipelines, and self-hosted media servers such as Jellyfin and Nextcloud. Security researchers demonstrated RCE on a Jellyfin media server and a Nextcloud instance by uploading a 50 KB AVI file, highlighting the broad attack surface.

Implications for Security and AI-Assisted Discovery

The discovery of a long-standing bug in a widely used framework, despite extensive automated testing, indicates a new wave of security flaw identification, partly attributed to the introduction of cybersecurity-focused frontier models. This incident underscores the ongoing challenges in securing foundational software components and the potential for new tools to uncover deeply embedded vulnerabilities.