FFmpeg 'PixelSmash' Flaw Enables RCE on Jellyfin, DoS on Major Media Apps

Executive Briefing

• Reveals CVE-2026-8461, a high-severity (8.8) heap buffer overflow in FFmpeg's MagicYUV video decoder affecting hundreds of applications
• Enables remote code execution on Jellyfin servers via malicious AVI/MKV/MOV files, with no user interaction required in torrent-based attack scenarios
• Affects Kodi, OBS Studio, Nextcloud, PhotoPrism, Emby, and potentially Slack, Discord, Telegram, and WhatsApp via server-side video previews
• Patches released in FFmpeg 8.1.2 and Jellyfin's bundled FFmpeg; Nextcloud declined to fix, citing the flaw as external to their codebase
• Plex remains unaffected due to a custom FFmpeg build with a minimal decoder allowlist, highlighting the supply-chain risk for other projects