CVE-2026-8461
Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.8EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
18 Jun 2026Published on NVD
23 Jun 2026Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.
This vulnerability is associated with the file libavcodec/magicyuv.C.
This issue affects FFmpeg before version 8.1.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
FFmpeg · FFmpegpublic PoCs found — 4
githubgithub.com/anyanything/CVE-2026-8461-PoC★ 5githubgithub.com/Y5neKO/CVE-2026-8461-EXP★ 4githubgithub.com/HORKimhab/CVE-2026-8461★ 1githubgithub.com/0xBlackash/CVE-2026-8461★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →