CVE-2026-8461

EUVD-2026-37878
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

 This vulnerability is associated with the file libavcodec/magicyuv.C.



This issue affects FFmpeg before version 8.1.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
JFROGCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux AI 3.5 for RHEL 9
0:6.1.6-1.el9ai ≤
𝑥
< *
ADP
ffmpegffmpeg
𝑥
< 8.1.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
ffmpeg
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
7:8.1.2-2
fixed
sid
7:8.1.2-2
fixed
trixie
7:7.1.5-0+deb13u1
fixed
trixie (security)
7:7.1.5-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ffmpeg
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
libav
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159
https://access.redhat.com/errata/RHSA-2026:43711
https://access.redhat.com/security/cve/CVE-2026-8461
https://bugzilla.redhat.com/show_bug.cgi?id=2490308
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json