Log in Start free

Vulnerability · Published Jun 18, 2026 · Assigned by JFROG

CVE-2026-8461Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

High 8.8

In plain English

A high-severity out-of-bounds write in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.6%top 24.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24ffmpeg8.1.2-r0ALPINE-CVE-2026-8461
Debian:12ffmpegno fix listedDEBIAN-CVE-2026-8461
Debian:13ffmpeg7:7.1.5-0+deb13u1DEBIAN-CVE-2026-8461
Debian:14ffmpeg7:8.1.2-1DEBIAN-CVE-2026-8461
Ubuntu:25.10ffmpegno fix listedUBUNTU-CVE-2026-8461
Ubuntu:26.10ffmpegno fix listedUBUNTU-CVE-2026-8461

Affected products (as reported)

VendorProductVersions
FFmpeg FFmpeg 0 – before 8.1.2

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References