The PixelSmash vulnerability (CVE-2026-8461) is a heap out-of-bounds write in FFmpeg's libavcodec MagicYUV decoder caused by inconsistent chroma plane height calculations between the frame allocator and decoder. This flaw enables remote code execution by targeting the AVBuffer struct, a refcounted buffer management object adjacent to pixel data. Attackers can embed a NUL-terminated shell command at a specific out-of-bounds offset to achieve shell execution before process crash. The vulnerability affects any application using FFmpeg's libavcodec for video decoding, including video players, file managers generating thumbnails, media servers, NAS devices, and cloud services. Exploitation vectors include opening malicious media files, browsing folders with vulnerable thumbnail generators, uploading files to media servers or cloud platforms, and zero-click attacks via torrent downloads. Successful exploitation has been demonstrated against multiple popular applications and platforms. FFmpeg 8.1.2 contains the official fix.

Successful exploitation allows remote code execution in any application using the vulnerable FFmpeg libavcodec library, potentially compromising desktop video players, media servers, NAS appliances, cloud transcoding pipelines, and other media-processing applications. No authentication or special privileges are required, and the attack surface includes simply delivering a crafted media file. This can lead to full system compromise of affected hosts. The vulnerability also enables zero-click attacks in scenarios such as automated media library scanning and server-side thumbnail generation.

An official fix is available in FFmpeg version 8.1.2. Users and administrators should update to this version or later as soon as possible to remediate the PixelSmash vulnerability. Until patched, avoid opening untrusted media files and disable automatic media processing features that use FFmpeg where feasible. No vendor advisory indicates that no action is required or that the issue is already mitigated; therefore, applying the official update is the recommended mitigation.