Executive brief
FFmpeg is a widely used software library for processing video and audio files. A vulnerability in its MagicYUV video decoder could allow an attacker to crash applications using the library or potentially execute unauthorized code if a user is tricked into opening a specially crafted video file. This could lead to service disruptions or the compromise of systems that process user-uploaded media.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in FFmpeg's libavcodec/magicyuv.c due to a failure to properly validate slice_height alignment with chroma vshift. An attacker can exploit this by providing a maliciously crafted MagicYUV video file. When processed by the decoder, the misalignment leads to an out-of-array access. This can result in a denial-of-service (crash) or remote code execution under certain conditions. The issue is fixed in FFmpeg version 8.1.2 by rejecting slice_height values that are misaligned with chroma vertical shifting.
Affected products
- FFmpeg FFmpeg < 8.1.2
Timeline
- 2026-05-25: patched: Fix merged into FFmpeg master branch
- 2026-06-18: advisory: CVE published by JFrog/NVD