CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...

CVE-2026-8461-PoC

CVE-2026-8461 PoC !WARNING This PoC is entirely generated by AI. Usage: python exploitcve20268461.py --baseline --frames 25 -o baseline.avi An unpatched version of ffmpeg will crash when processing baseline.avi...

CVE-2026-125250

A flaw was found in FFmpeg. A heap buffer overflow can occur in the GIF encoder when transcoding a specially crafted PAL8 video file due to a failure to resize the output buffer when the frame linesize grows mid-stream. This vulnerability can lead to memory corruption, potentially resulting in an...

CVE-2026-125209

A flaw was found in FFmpeg. A heap buffer overflow can occur in the DVD subtitle encoder when transcoding a media file containing crafted bitmap subtitles due to underestimating the RLE Run-Length Encoding output size for odd-width rectangles. This vulnerability can lead to memory corruption,...

CVE-2026-125262

A flaw was found in FFmpeg. A heap buffer overflow can occur in the LCEVC decoder when decoding a specially crafted H.264 or HEVC video file due to a missing validation of output picture dimensions against the allocated frame. This vulnerability can lead to memory corruption, potentially resultin...

CVE-2026-125233

A flaw was found in FFmpeg. A heap buffer overflow can occur in the DVB subtitle encoder when transcoding a specially crafted media file containing many bitmap subtitle rectangles due to undercounting the CLUT Color Look-Up Table segment headers. This vulnerability can lead to memory corruption,...

CVE-2026-125229

A flaw was found in FFmpeg. An out-of-bounds write can occur in the HEVC H.265 decoder when decoding a specially crafted HEVC video file due to a missing validation of minimum frame dimensions for the median predictor. This vulnerability can lead to memory corruption, potentially resulting in an...

CVE-2026-125264

A flaw was found in FFmpeg. A CPU exhaustion issue can occur in the JPEG XL parser when processing a specially crafted JPEG XL file due to a failure to validate TOC Table of Contents entry counts against the remaining input. This vulnerability can lead to an excessive consumption of CPU resources...

CVE-2026-125171

A flaw was found in FFmpeg. An out-of-bounds read can occur in the Musepack SV7 audio decoder when decoding a specially crafted Musepack SV7 file with an oversized final frame due to a missing validation of lastframelen against MPCFRAMESIZE. This vulnerability can lead to an application crash or...

CVE-2026-125204

A flaw was found in FFmpeg. A heap buffer overflow can occur in the libwebp encoder via a specially crafted media file that increases resolution mid-stream when the crthreshold option is set, writing pixel data past the stale reference frame. This vulnerability can lead to memory corruption,...

CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...

practice-22-23

Project To run: ./script.sh GitHub repository - https://github.com/LaCinquette/practice-22-23 Progress 1. For vulnerability research I chose the FFmpeg project. I found a commit that met the requirements, namely: Matched the type CWE-476 - null pointer dereference 2. Created a Dockerfile in which...

PixelSmash

CVE-2026-8461 — PixelSmash A working proof-of-concept for CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder. Includes a lab harness that builds a vulnerable FFmpeg from source, and a small Qt player used to demonstrate the exploit in a video-player context. For research and...

GHSA-3F4Q-8X5M-76V8 Active Storage: Possible local file disclosure in video previews and analysis

Impact Active Storage's VideoPreviewer, VideoAnalyzer and AudioAnalyzer run ffmpeg and ffprobe on a blob's contents without restricting the input format, so FFmpeg selects a demuxer by probing the file. A blob created through a direct upload keeps the content type the client declared, so a client...

Active Storage: Possible local file disclosure in video previews and analysis

Impact Active Storage's VideoPreviewer, VideoAnalyzer and AudioAnalyzer run ffmpeg and ffprobe on a blob's contents without restricting the input format, so FFmpeg selects a demuxer by probing the file. A blob created through a direct upload keeps the content type the client declared, so a client...

EUVD-2026-123059

Active Storage: Possible local file disclosure in video previews and analysis...

CVE-2026-125104

A flaw was found in FFmpeg. A memory exhaustion issue can occur in the APE Monkey's Audio decoder when decoding specially crafted legacy APE audio files due to a failure to enforce the sample limit on frame sizes. This vulnerability can lead to an excessive consumption of memory resources,...

CVE-2026-125073

A flaw was found in FFmpeg. A CPU exhaustion issue can occur in the IMC and IAC audio decoders when decoding specially crafted audio files due to a failure to handle negative bit budgets. This vulnerability can lead to an excessive consumption of CPU resources, eventually resulting in a denial of...

CVE-2026-26833

CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...

Security update for ffmpeg

This update for ffmpeg fixes the following issues: CVE-2023-6602: HLS Force TTY Demuxer bsc1220546. CVE-2023-6604: HLS XBIN Demuxer DoS Amplification bsc1220549. CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dspaltivec.c, static const vecs8 hsubpelfiltersouter...