JFrog discovered a critical vulnerability in the FFmpeg media processing framework, tracked as CVE-2026-8461 and dubbed PixelSmash. The flaw, assigned a CVSS score of 8.8, is a heap out-of-bounds write within FFmpeg's libavcodec library, specifically affecting the MagicYUV decoder. "The vulnerability is a one-row heap buffer overflow in the MagicYUV decoder's slice handling, caused by an inconsistency between how the frame allocator and the decoder compute chroma plane heights," JFrog said.

The vulnerability enables attackers to crash applications and, under specific conditions, execute arbitrary code remotely. The exploit payload can be delivered through media files as small as 50 KB, in formats such as AVI, MKV, or MOV. Exploitation for remote code execution requires Address Space Layout Randomization (ASLR) to be disabled or the vulnerability to be combined with another existing bug.

JFrog confirmed successful exploitation of the bug across several applications, including Kodi, mpv, ffmpegthumbnailer, Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, and OBS Studio. The ffmpegthumbnailer application is used by desktop environments such as GNOME, KDE, and XFCE. "No authentication, special privileges, or prior access to the target system is required beyond the ability to deliver a media file – the default attack surface for any media-processing application," JFrog said.

The firm demonstrated remote code execution against Jellyfin, a self-hosted media server. "To demonstrate the real-world impact, we achieved full remote code execution against a Jellyfin 10.11.9 media server - the second-most popular self-hosted media server (after Plex) - through its normal media library scan pipeline," JFrog said. Jellyfin has since updated its bundled FFmpeg version.

JFrog reported the vulnerability to the FFmpeg security team on May 13, 2026. FFmpeg released version 8.1.2 on June 17, 2026, which contains fixes for the PixelSmash vulnerability. The Nextcloud team received the vulnerability report via HackerOne but decided not to address the flaw, citing that it exists outside of Nextcloud's direct code. PhotoPrism is working on implementing a file format blocklist to prevent potential exploitation. Plex uses a custom FFmpeg build with disabled decoders and a minimal allowlist.

Applications like Slack, Discord, Telegram, and WhatsApp utilize FFmpeg to generate server-side video previews. These applications were not specifically tested for the PixelSmash vulnerability by JFrog.