---
id: 6358
title: "[CVE-2026-8461] PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons"
cve: CVE-2026-8461
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/"
published_at: "2026-06-22T13:15:23Z"
tags: ["rce", "vulnerabilities", "ffmpeg", "jfrog-research", "cve-2026-8461", "media-processing"]
phying_url: "https://phying.com/item/6358"
lang: en
---

# [CVE-2026-8461] PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons

## Summary

JFrog discloses PixelSmash (CVE-2026-8461), a CVSS 8.8 FFmpeg MagicYUV heap bug where a crafted 50 KB media file yields RCE against apps like Jellyfin and Nextcloud; fixed in 8.1.2.

## Intelligence Metadata

- **Sources:** jfrog.com
- **CVE:** CVE-2026-8461
- **Published:** 2026-06-22T13:15:23Z
- **Original:** https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
- **Phying News:** https://phying.com/item/6358