FFmpeg 8.1.2 vulnerability (CVE-2026-8461)

Support Software & Applications
1

What about ffmpeg 8.1.2 (CVE-2026-8461)?

[Stable Update] 2026-06-26 - Kernels, Systemd, PipeWire, NVIDIA, KDE, LibreOffice
Any changes to Firefox that would alter conversion of blobs in object URL src?
2

Sure, but I was under the impression that fixes for critical vulnerabilities like this one (PixelSmash Critical FFmpeg Vulnerability CVE-2026-8461 Turns Video into a Host for Remote Code Execution) are expedited or like in the case of Dirty Frag a note about temporary mitigation is posted.
So maybe it was overlooked or not critical enough?

1 Like
3

I cannot say.

What I do know is - viewing a video is usually initiated by the user - I know that some sites insist on playing video the moment you enter - so to avoid this you can disable media auto-play in your browsers settings.

The video has to be specifically crafted, so it it is likely only triggered by visiting questionable content - so for as long as you only view content from safe locations - you should not worry.

1 Like
4

At least according to Mastodon comments it needs ASLR to be disabled to do the attack. ASLR should be enabled by default with modern Linux kernels. At least on kernel 6.18 it’s enabled. To check if it’s enabled run cat /proc/sys/kernel/randomize_va_space . Should return 2 if it’s enabled fully. 0 if disabled.

Also BleepingComputer had reported that ASLR needs to be disabled for the attacks to work.

7 Likes
5 
uname -a
  • Linux manjaro25 7.0.10-1-MANJARO #1 SMP PREEMPT_DYNAMIC Sun, 24 May 2026 04:47:00 +0000 x86_64 GNU/Linux
  • Linux manjaro25 7.0.13-1-MANJARO #1 SMP PREEMPT_DYNAMIC Fri, 19 Jun 2026 12:34:29 +0000 x86_64 GNU/Linux
cat /proc/sys/kernel/randomize_va_space

2
:footprints:

6

CVE-2026-8461 - Vulnerability Details - OpenCVE

Published: 2026-06-18

Description

An out-of-bounds write vulnerability in FFmpeg’s libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

This vulnerability is associated with the file libavcodec/magicyuv.C.

Affected Systems

FFmpeg versions earlier than 8.1.2 are affected. The vulnerability resides in the libavcodec/magicyuv.C file of the FFmpeg codebase.

OpenCVE Recommended Actions

  • Upgrade FFmpeg to version 8.1.2 or later and replace any older binaries in playback or streaming services.
  • Reconfigure or disable the MagicYUV decoder in FFmpeg if the application allows it, to eliminate the code path where the flaw exists.
  • Restart affected services after applying the upgrade to ensure the patched library is loaded and verify that no legacy FFmpeg components remain deployed.
7

I see there is an update for ffmpeg and ffmpeg4.4 for me on unstable rn…

ffmpeg                       2:8.1.2-6     -> 2:8.1.2-7      extra
ffmpeg4.4                    4.4.8-1       -> 4.4.8-2        extra

what is this 4.4 package?

❯ pamac info ffmpeg4.4
Name                  : ffmpeg4.4
Version               : 4.4.8-1
Description           : Complete solution to record, convert and stream audio and video
URL                   : https://ffmpeg.org/
Licences              : GPL-3.0-only
Repository            : extra
Installed Size        : 25.3 MB
Groups                : --
Depends On            : alsa-lib aom bzip2 cairo fontconfig fribidi glib2 glibc gmp gnutls gsm jack lame libass.so=9-64 libavc1394 libbluray.so=3-64
                        libdav1d.so=7-64 libdrm libfreetype.so=6-64 libiec61883 libmfx libmodplug libpulse librav1e.so=0.8-64 libraw1394
                        librsvg-2.so=2-64 libsoxr libssh libtheora libva.so=2-64 libva-drm.so=2-64 libva-x11.so=2-64 libvdpau libvidstab.so=1.2-64
                        libvorbisenc.so=2-64 libvorbis.so=0-64 libvpx.so=12-64 libwebp libx11 libx264.so=165-64 libx265.so=216-64 libxcb libxext
                        libxml2 libxv libxvidcore.so=4-64 libzimg.so=2-64 opencore-amr openjpeg2 opus sdl2 speex srt svt-av1 v4l-utils xz zlib
Optional Dependencies : avisynthplus: AviSynthPlus support
                        intel-media-sdk: Intel QuickSync support
                        ladspa: LADSPA filters [Installed]
                        nvidia-utils: Nvidia NVDEC/NVENC support
Required By           : --
Optional For          : --
Provides              : libavcodec.so=58-64 libavdevice.so=58-64 libavfilter.so=7-64 libavformat.so=58-64 libavutil.so=56-64 libpostproc.so=55-64
                        libswresample.so=3-64 libswscale.so=5-64
Replaces              : --
Conflicts With        : --
Packager              : Maxime Gauduin <alucryd@archlinux.org>
Build Date            : Tue 23 Jun 2026 01:10:57 IST
Install Date          : Wed 24 Jun 2026 10:31:27 IST
Install Reason        : Installed as a dependency for another package
Validated By          : Signature
Backup files          : --
8

ffmpeg.org – Download – Releases

Approximately every 6 months the FFmpeg project makes a new major release. Between major releases point releases will appear that add important bug fixes but no new features

FFmpeg 4.4.8 “Rao”

4.4.8 was released on 2026-06-21. It is the latest stable FFmpeg release from the 4.4 release branch, which was cut from master on 2021-04-08.

9

Looking at ffmpeg’s changelog (or rather, vulnerability log) at

it seems while version 8.1.2 already contains 3 fixes for CVE-2026-8461 “Pixelsmash”,
the newer git master branch even contains 3 more fixes for same issue to appear in a future release - along with fixes for four (as of now) further CVEs.

I found no explanation / discussion of the current status, nor any indication if the 4.4 compatibility release is affected or not. Fair enough, I guess the guys are just too busy fixing the current flood of disclosures. Meanwhile I am not too concerned while ASLR is enabled on my system.

Disclaimer: this is only my impression from browsing their web; I am not involved in any ffmpeg internals.

1 Like