This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] FFmpeg fixes a high-severity vulnerability
FFmpeg (a multimedia framework used by popular applications such as VLC Media Player and OBS Studio) fixes a high-severity vulnerability in the MagicYUV decoder in version 9.0. Debian released a fix for trixie in version 7:7.1.5-0+deb13u1 and for forky/sid in version 7:8.1.2-2 [1]. Whether a build contains the vulnerable decoder can be verified with the command "ffmpeg -decoders 2>/dev/null | grep magicyuv" (a vulnerable build prints "VFS..D magicyuv"). If an update is not immediately possible, the vulnerable decoder can be disabled at build time with "--disable-decoder=magicyuv" [2].
Allows an unauthenticated remote attacker to cause a DoS attack or achieve arbitrary code execution by means of a specially crafted media file, due to a heap out-of-bounds write in the MagicYUV decoder. It is enough for an application using FFmpeg to process the file, for example when opening it, uploading it to a server or automatically generating a preview [1][2].
The vulnerability is present in product:
- FFmpeg; <9.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-8461 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 18. 6. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 25. 6. 2026.