CVE-2026-8461

Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

No known exploitation. EPSS puts it in the 62nd percentile. No fix published yet.

CVSS 3.18.8High EPSS percentile62nd1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-06-18Updated 2026-07-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your system uses a vulnerable FFmpeg version (any FFmpeg before 8.1.2) in the apps that decode AVI/MKV/MOV files.
Identify which of those apps pass uploaded or internet-sourced media to FFmpeg’s libavcodec (MagicYUV decode path).
Upgrade FFmpeg to 8.1.2 or later across every server/container where it’s used.
If you can’t upgrade right away, block or quarantine untrusted uploaded media and disable automatic decoding for unknown file types until the update is applied.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

In plain language

Written by AI from the record

CVE-2026-8461 is a FFmpeg weakness in the MagicYUV decoder that can crash (and sometimes allow code execution) when your software opens a specially crafted video file; if you process untrusted video from users or the internet, you should update to FFmpeg 8.1.2 soon.

In FFmpeg’s libavcodec MagicYUV decoder, a crafted video can trigger a heap out-of-bounds write via an unusual slice height, leading to denial-of-service and potentially remote code execution when applications process the file (network-delivered media; no authentication required).

If you're affected

Application crashes from bad video
Potential remote code execution
Service disruption for media workflows
Compromise of the hosting system

What is it

FFmpeg is a common “video decoding engine” that many apps use to open and process video files. This bug is in one of FFmpeg’s video formats/paths (MagicYUV) and can be triggered by a specially crafted video, which can make the app crash—and in worst cases let an attacker run code. Think of it like a broken “size calculator” inside the video reader that can be fooled by a malformed file.

Who is affected

This matters if you run software that uses FFmpeg (the FFmpeg libavcodec library) to open or process video files such as AVI, MKV, or MOV, especially when files come from customers, the public internet, or other untrusted sources. The attacker doesn’t need an account, but they do need you to process a malicious media file (user interaction via opening/decoding the file). This is relevant when the vulnerable FFmpeg version is reachable through those media workflows; the findings do not confirm whether a default setup is exposed without those decoding actions.

How urgent is it

This is an AMBER issue because it can lead to denial-of-service and potentially remote code execution when a malicious media file is processed. There’s no confirmed public, dated exploitation report in the findings, but the presence of a high-impact bug in a widely used decoder and rising patch attention means you should prioritize the upgrade to the fixed release. Treat it as urgent for any business that decodes untrusted video.

What to do — in detail

Confirm whether you’re affected

Determine the FFmpeg version(s) on every host/container that runs media decoding (especially any service using FFmpeg’s libavcodec).
Affected condition is: FFmpeg before 8.1.2.
Also confirm which apps feed user-provided or internet-provided files into FFmpeg for decoding (the issue is triggered when the MagicYUV decoder is reached while processing specially crafted media).

Upgrade / remediation

Upgrade FFmpeg to 8.1.2 or later everywhere it’s used.
If you use containers, update the base image and redeploy.
If FFmpeg is bundled with a product (e.g., a media server/app), upgrade that product to a release that includes FFmpeg 8.1.2 or newer.

Workaround while patching

Stop automatic decoding/previewing of uploaded files from untrusted users.
Quarantine or block unknown/untrusted file uploads where feasible.
Restrict which file types you accept from users (and ensure FFmpeg isn’t invoked for other formats).

What to monitor

Watch for crashes or abnormal errors in video processing services after deployments and when handling new uploads.
If you have application logs, review decoder-related failures around the time of problematic uploads.

KEV / timing

This CVE is not listed in CISA KEV per the provided findings, so there is no KEV-driven fixed deadline included here.

Technical context

Severity/impact: High (CVSS 8.8 shown in the prompt). The vulnerability is a heap out-of-bounds write (CWE-787) in FFmpeg’s MagicYUV decoder in libavcodec. Mechanism: a specially crafted video file with an unusual slice height causes an inconsistency in how the decoder/allocator calculates chroma plane heights, leading to a write past allocated heap boundaries. Outcomes: denial-of-service is expected (crash), and remote code execution is possible in some cases.

Exploitation status: No clear dated active exploitation claim is provided in the supplied news findings, and there is no public exploit code on record in the findings. However, the findings state the vulnerability can enable RCE/DoS when a malicious file is processed by applications using libavcodec.

Reachability/interaction: Network delivery is possible (malicious media can be sent over the network), but authentication is none and user interaction is required—the attacker must get the application to process the crafted media file.

Fix: FFmpeg is fixed in 8.1.2.

KEV meaning: KEV listing would indicate CISA has high-confidence, known exploitation; here, it is not listed in KEV per the provided findings.

EPSS: A prediction is provided (do not treat as proof of exploitation), and the verdict emphasis is on the confirmed technical impact and patch availability described in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS62nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 62nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 35 days, from the signal feeds we watch.

2026-07-23Record updated
2026-07-15Record updated
2026-06-30Record updated
2026-06-25OpenVAS check added
2026-06-18Publishedweakness classified, att&ck mapped

Affected products

FFmpegoss-project · USaka libavcodec
- FFmpegLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable