CVE-2026-8461

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

This vulnerability is associated with the file libavcodec/magicyuv.C.

This issue affects FFmpeg before version 8.1.2.

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A flaw was found in FFmpeg s TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.(CVE-2023-6602)

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

This vulnerability is associated with the file libavcodec/magicyuv.C.

This issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

This vulnerability is associated with the file libavcodec/magicyuv.C.

This issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

This vulnerability is associated with the file libavcodec/magicyuv.C.

This issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

This vulnerability is associated with the file libavcodec/magicyuv.C.

This issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

The updated packages fix a security vulnerability: Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder. (CVE-2026-8461)

These are all security issues fixed in the ffmpeg-8-8.1.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-4-4.4.8-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-7-7.1.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ffmpeg-7 fixes the following issues:

• CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).
• CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).
• CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer (bsc#1234029).
• CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while (bsc#1234017).
• CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382).
• CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).
• CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).
• CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption (bsc#1269550).
• CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).
• CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).
• CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).
• CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).
• CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
• CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).
• CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
• CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).
• CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).
• CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads (bsc#1274270).
• CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory reads (bsc#1274282).
• CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads (bsc#1274287).
• CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes (bsc#1274289).
• CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).
• CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
• CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).
• CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
• CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).

Changes for ffmpeg-7:

Update to version 7.1.5:

• Various crash, out-of-bounds access, add boundary check fixes. Affected: .mov parser, DASH parser, Snow encoder, Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech, ADPCM, Matroska decoder
• avcodec/jpeg2000dec: clear array length when freeing it (CVE-2025-22921, bsc#1237382)
• avcodec/magicyuv: Fix 1 line MEDIAN slices (CVE-2026-8461, bsc#1269490)
• avcodec/magicyuv: reject slice_height misaligned with chroma vshift.
• avcodec/magicyuv: Expand the s->interlaced slice-height sanity check.
• avcodec/rasc: fix heap use-after-free in decode_move(). (CVE-2026-12706, bsc#1268595)
• avformat/hls: Be more picky on extensions. (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)
• lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so a thread for vp9 decoding might get stuck. (CVE-2024-36615, bsc#1234017).
• avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585) (CVE-2024-36615, bsc#1234017)
• lavc/vp9: Fix regression introduced in 0ba0585. *…

This update for ffmpeg-4 fixes the following issues:

Update to release 4.4.8.

• CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution (bsc#1269490).
• CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).
• CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution (bsc#1272752).
• CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption (bsc#1272754).
• CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory corruption (bsc#1272758).
• CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information disclosure (bsc#1272768).
• CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code execution (bsc#1272765).

Other updates and bugfixes:

• Release 4.4.8
  • Various bug fixes to codecs
  • avcodec/magicyuv: Fix 1 line MEDIAN slices
  • avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
  • avcodec/magicyuv: reject slice_height misaligned with chroma vshift

This update for ffmpeg-4 fixes the following issues:

Update to release 4.4.8.

• CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution (bsc#1269490).
• CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).
• CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution (bsc#1272752).
• CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption (bsc#1272754).
• CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory corruption (bsc#1272758).
• CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information disclosure (bsc#1272768).
• CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code execution (bsc#1272765).

Other updates and bugfixes:

• Release 4.4.8
  • Various bug fixes to codecs
  • avcodec/magicyuv: Fix 1 line MEDIAN slices
  • avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
  • avcodec/magicyuv: reject slice_height misaligned with chroma vshift

This update for ffmpeg fixes the following issue:

• CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution (bsc#1269490).

Seung Min Shin discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-12706)

Xinghang Lv discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-30999)

It was discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-58049)

Adrian Junge discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could leak sensitive information. (CVE-2026-70629, CVE-2026-70630, CVE-2026-70631)

Ori Hollander discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly cause a denial of service or execute arbitrary code. (CVE-2026-8461)