FFmpeg fixes PixelSmash flaw in widely used video decoder
Source Bleeping Computer
Mentioned vulnerabilities
Fixed in 8.1.2 : patch affected systems soon.
Data as of 23 Jun 2026, 17:15 UTC
Rated High by Threat Radar from the Bleeping Computer text
- Patch
- Available – fixed in 8.1.2
What to do
AI-suggested
A fix is available in FFmpeg version 8.1.2, released on June 17, 2026, which addresses the PixelSmash vulnerability. Users and administrators of affected applications should update to this or later FFmpeg versions. Jellyfin has updated its bundled FFmpeg to mitigate the issue. PhotoPrism is implementing file format blocklists as an additional mitigation. Applications that disable the MagicYUV decoder or use custom FFmpeg builds with minimal decoder allowlists (e.g., Plex) are effectively protected. Nextcloud has declined to address the flaw directly as it exists outside their core product. If you cannot patch yet, avoid processing untrusted video files in vulnerable applications. Patch status is confirmed by the FFmpeg advisory.
Description
A newly disclosed FFmpeg flaw dubbed 'PixelSmash' could be exploited for remote code execution on Jellyfin servers under certain conditions, and can also trigger a denial-of-service condition in applications like Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio. [...]