CVE detail
CVE-2026-8461
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 22.0 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 1
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
8 source links · newest first
- PixelSmash flaw turns video files into attack toolsMalwarebytes Labs
Researchers have found a critical FFmpeg flaw that could let attackers use a malicious video file to compromise vulnerable systems.
newswww.malwarebytes.comJun 24, 2026, 5:23 PM A newly discovered critical vulnerability in the FFmpeg media processing framework bundled in a huge number of open source and commercial applications points, again, to the need for CSOs to have strategies to deal with software supply chain vulnerabilities, which should include demanding a software bill of materials for all products. Found by researchers at […]
newswww.csoonline.comJun 24, 2026, 12:23 AMAttackers can send crafted media files to execute code in any application that uses FFmpeg’s libavcodec library.
newswww.securityweek.comJun 23, 2026, 11:48 AM- https://access.redhat.com/errata/RHSA-2026:43711access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 18, 2026, 2:17 PM - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comJun 18, 2026, 2:17 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2490308bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comJun 18, 2026, 2:17 PM - https://access.redhat.com/security/cve/CVE-2026-8461access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 18, 2026, 2:17 PM - https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159code.ffmpeg.org
No excerpt available.
Patchcode.ffmpeg.orgJun 18, 2026, 2:17 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-16807CVSS N/A · Unrated
Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit…
- CVE-2026-65706CVSS 8.5 · High
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted…
- CVE-2026-65705CVSS 7.3 · High
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamic…
- CVE-2026-65704CVSS 7.3 · High
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 f…
- CVE-2026-65703CVSS 8.5 · High
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a craft…
- CVE-2026-64835CVSS 8.7 · High
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both ou…