PT-2026-50667 · FFmpeg · Ffmpeg
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FFmpeg versions prior to 8.1.2
Description
A heap out-of-bounds write flaw, dubbed PixelSmash, exists in the
libavcodec library, specifically within the MagicYUV decoder. The issue stems from a rounding mismatch in the slice handling code where improper validation of the slice height variable allows an attacker to manipulate buffer memory. By providing a specially crafted media file in AVI, MKV, or MOV format (as small as 50 KB), a remote attacker can cause a denial-of-service or execute arbitrary code.Technical exploitation involves overflowing the chroma plane buffer to overwrite the
AVBuffer structure, which contains a function pointer. By replacing this pointer with the address of the system() function and providing a shell command, the attacker can achieve remote code execution during normal frame cleanup when av frame unref() is called. This can be triggered without user interaction (zero-click) through automatic media library scanning, metadata extraction, or thumbnail generation in applications such as Jellyfin, Nextcloud, Kodi, Emby, Immich, and OBS Studio. The vulnerability is considered a supply chain risk due to the widespread integration of libavcodec across various media servers, cloud platforms, and IoT devices.Recommendations
Update FFmpeg to version 8.1.2 or later.
As a temporary mitigation, disable the MagicYUV decoder or restrict the processing of untrusted media files.
Fix
RCE
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ffmpeg