FFmpeg MagicYUV Decoder OOB Write Crash (CVE-2026-8461)

Summary

CVE-2026-8461 is a high-severity out-of-bounds write in FFmpeg's MagicYUV decoder (libavcodec/magicyuv.c) (CVSS 8.8). anyanything/CVE-2026-8461-PoC generates a crafted baseline.avi that crashes unpatched FFmpeg during decode. JFrog advisory notes DoS and, in some cases, remote code execution when victims process attacker-controlled media. Fixed in FFmpeg 8.1.2.

Distinct from the Exploitarium RASC DLTA heap OOB write — different decoder, different primitive, different upstream researcher.

Upstream README discloses the PoC script was AI-generated.

Key Findings

Attack Chain

Attacker generates baseline.avi (MagicYUV bitstream with OOB trigger)
        ↓
Victim runs ffmpeg/ffplay on file (transcode pipeline, thumbnailer, media server)
        ↓
magicyuv decoder writes past buffer bounds
        ↓
Process crash (DoS) or memory corruption → potential RCE (advisory-dependent)

Impact

Media pipelines, thumbnail generators, and desktop players linking vulnerable FFmpeg builds are exposed. Container images shipping pre-8.1.2 FFmpeg need rebuild.

Mitigation

1. Upgrade FFmpeg to 8.1.2+ or vendor-patched packages (Red Hat, Ubuntu security notices).
2. Sandbox transcoding of untrusted uploads; block MagicYUV in restricted environments if supported.
3. Monitor crash telemetry from ffmpeg worker processes processing external media.

Related Signals

• Exploitarium — FFmpeg RASC DLTA calc PoC — separate FFmpeg heap primitive
• Exploitarium — VLC VP9 crash
• Exploitarium collection

Sources

• Sploitus — CVE-2026-8461 PoC
• GitHub — anyanything/CVE-2026-8461-PoC
• FFmpeg pull request #23159
• NVD — CVE-2026-8461
• Red Hat — CVE-2026-8461