PixelSmash

CVE-2026-8461 — PixelSmash A working proof-of-concept for CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder. Includes a lab harness that builds a vulnerable FFmpeg from source, and a small Qt player used to demonstrate the exploit in a video-player context. For research and...

PixelSmash flaw turns video files into attack tools

A newly discovered vulnerability in FFmpeg’s MagicYUV decoder can turn a tiny, malformed video into a foothold for attackers. Researchers have disclosed PixelSmash, a critical vulnerability tracked as CVE-2026-8461, in FFmpeg’s MagicYUV video decoder with a CVSS score of 8.8. By crafting a...