Skip to content
Connect AISign inSign up free
CVE-2026-84618.8HighCWE-787

CVE-2026-8461: Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

FFmpeg

Fixed in 8.1.2 · Affected: FFmpeg before 8.1.2 · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public5 public GitHub repositories (unverified), listed by PoC-in-GitHub23 Jun
  5. Not established: not seen
1.6%probability of exploitation in the next 30 days
75th percentile
050100

Higher than 75% of scored CVEs

8.8HighCVSS 3.1
LowHigh

DescriptionNVD

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas
Exploitation
Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV
Not listed
Public check
No public nuclei template
Weakness
Out-of-bounds Write · Memory Corruption
Vendor
FFmpeg
Published
June 2026
Band
Possible (1 to 10%), June 2026

What changed

  1. PoC-in-GitHub lists 5 public GitHub repositories (unverified) PoC-in-GitHub

Coverage3 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: SecurityWeek, 23 Jun.

Full timeline
Quiet for 20 weekslast report 26 Jun3 articles3 outlets
23 Jun · SecurityWeek first5 Sep30 Sep25 OctNow
  • Tue 23 Jun, 11:54 UTC. SecurityWeek, first report. FFmpeg PixelSmash flaw lets hackers run code via crafted media.
  • Wed 24 Jun, 17:40 UTC. Malwarebytes, its first report on the story. Critical FFmpeg MagicYUV flaw allows remote code via video.
  • Fri 26 Jun, 02:21 UTC. SecurityOnline, its first report on the story. FFmpeg MagicYUV flaw lets hackers run code via crafted files.
All coveragerunning total3SecurityWeek1Malwarebytes1SecurityOnl…124 Jun12 Aug30 SepNow
  • First report
  • Article
  • Running total
Show as table
3 articles about CVE-2026-8461 from 3 outlets
Published (UTC)OutletHeadline
23 Jun 11:54SecurityWeekFFmpeg PixelSmash flaw lets hackers run code via crafted media
24 Jun 17:40MalwarebytesCritical FFmpeg MagicYUV flaw allows remote code via video
26 Jun 02:21SecurityOnlineFFmpeg MagicYUV flaw lets hackers run code via crafted files
  1. FFmpeg MagicYUV flaw lets hackers run code via crafted files
    SecurityOnline
  2. Critical FFmpeg MagicYUV flaw allows remote code via video
    Malwarebytes
  3. FFmpeg PixelSmash flaw lets hackers run code via crafted media
    SecurityWeek · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Sign inSign up free

Updated