TLDR Tech / InfoSec
FFmpeg fixes PixelSmash flaw in widely used video decoder
FFmpeg patched CVE-2026-8461 (CVSS 8.8), a heap out-of-bounds write in the MagicYUV decoder enabling DoS across Kodi, OBS Studio, PhotoPrism, and Nextcloud and full RCE on Jellyfin via crafted AVI/MKV/MOV files when ASLR is disabled.
Read the full story