CVE-2026-8461

FFmpeg is a common “video decoding engine” that many apps use to open and process video files. This bug is in one of FFmpeg’s video formats/paths (MagicYUV) and can be triggered by a specially crafted video, which can make the app crash—and in worst cases let an attacker run code. Think of it like a broken “size calculator” inside the video reader that can be fooled by a malformed file.

This matters if you run software that uses FFmpeg (the FFmpeg libavcodec library) to open or process video files such as AVI, MKV, or MOV, especially when files come from customers, the public internet, or other untrusted sources. The attacker doesn’t need an account, but they do need you to process a malicious media file (user interaction via opening/decoding the file). This is relevant when the vulnerable FFmpeg version is reachable through those media workflows; the findings do not confirm whether a default setup is exposed without those decoding actions.

This is an AMBER issue because it can lead to denial-of-service and potentially remote code execution when a malicious media file is processed. There’s no confirmed public, dated exploitation report in the findings, but the presence of a high-impact bug in a widely used decoder and rising patch attention means you should prioritize the upgrade to the fixed release. Treat it as urgent for any business that decodes untrusted video.

Confirm whether you’re affected

• Determine the FFmpeg version(s) on every host/container that runs media decoding (especially any service using FFmpeg’s libavcodec).
• Affected condition is: FFmpeg before 8.1.2.
• Also confirm which apps feed user-provided or internet-provided files into FFmpeg for decoding (the issue is triggered when the MagicYUV decoder is reached while processing specially crafted media).

Upgrade / remediation

• Upgrade FFmpeg to 8.1.2 or later everywhere it’s used.
• If you use containers, update the base image and redeploy.
• If FFmpeg is bundled with a product (e.g., a media server/app), upgrade that product to a release that includes FFmpeg 8.1.2 or newer.

Workaround while patching

• Stop automatic decoding/previewing of uploaded files from untrusted users.
• Quarantine or block unknown/untrusted file uploads where feasible.
• Restrict which file types you accept from users (and ensure FFmpeg isn’t invoked for other formats).

What to monitor

• Watch for crashes or abnormal errors in video processing services after deployments and when handling new uploads.
• If you have application logs, review decoder-related failures around the time of problematic uploads.

KEV / timing

• This CVE is not listed in CISA KEV per the provided findings, so there is no KEV-driven fixed deadline included here.

Severity/impact: High (CVSS 8.8 shown in the prompt). The vulnerability is a heap out-of-bounds write (CWE-787) in FFmpeg’s MagicYUV decoder in libavcodec. Mechanism: a specially crafted video file with an unusual slice height causes an inconsistency in how the decoder/allocator calculates chroma plane heights, leading to a write past allocated heap boundaries. Outcomes: denial-of-service is expected (crash), and remote code execution is possible in some cases.

Exploitation status: No clear dated active exploitation claim is provided in the supplied news findings, and there is no public exploit code on record in the findings. However, the findings state the vulnerability can enable RCE/DoS when a malicious file is processed by applications using libavcodec.

Reachability/interaction: Network delivery is possible (malicious media can be sent over the network), but authentication is none and user interaction is required—the attacker must get the application to process the crafted media file.

Fix: FFmpeg is fixed in 8.1.2.

KEV meaning: KEV listing would indicate CISA has high-confidence, known exploitation; here, it is not listed in KEV per the provided findings.

EPSS: A prediction is provided (do not treat as proof of exploitation), and the verdict emphasis is on the confirmed technical impact and patch availability described in the findings.