PixelSmash: FFmpeg’s MagicYUV bug lets a 50 KB video hijack servers
JFrog Security Research uncovered CVE‑2026‑8461, a heap out‑of‑bounds write in FFmpeg’s MagicYUV decoder that lets a crafted video file trigger remote code execution on any app using FFmpeg. The flaw, present for 16 years, compromises desktop players, thumbnail generators, and self‑hosted media servers like Jellyfin and Nextcloud. Patch FFmpeg immediately or disable MagicYUV to stop the attack chain.