Vulnerability intelligence
CVE-2026-8461
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
CVSS Score
8.8
High
EPSS — Exploit Probability
1.6%
Riskier than 74% of all CVEs · checked 2026-09-21
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
3 articles across 3 outlets · first covered Jun 23, 2026 · latest Jun 26, 2026
Coverage timeline
-
FFmpeg MagicYUV flaw lets hackers run code via crafted filessecurityonline.info · Jun 26, 2026
-
Critical FFmpeg MagicYUV flaw allows remote code via videowww.malwarebytes.com · Jun 24, 2026
-
FFmpeg PixelSmash flaw lets hackers run code via crafted mediawww.securityweek.com · Jun 23, 2026