FFmpeg is vulnerable to a Heap Out-of-Bounds Write in the MagicYUV Decoder (PixelSmash)
ffmpeg (libavcodec/magicyuv.c)
< 8.1.2
A heap-based out-of-bounds write exists in the MagicYUV decoder (libavcodec/magicyuv.c). magy_decode_frame reads slice_height from the bitstream and validates it only against INT_MAX. When slice_height has low bits that are not aligned to the chroma vertical subsampling factor (vshift), the per-slice chroma destination pointer computed via AV_CEIL_RSHIFT rounds up on every slice, so the cumulative row offset exceeds the chroma plane buffer size allocated by av_image_fill_plane_sizes. A crafted MagicYUV-encoded media file (AVI/MKV/MOV) can therefore write attacker-controlled data past the end of the chroma plane heap buffer when decoded. Under typical glibc heap layouts this can corrupt adjacent heap metadata and function pointers (for example AVBuffer.free), enabling denial of service and, in some environments, remote code execution. The MagicYUV decoder is enabled by default in common FFmpeg builds.
Upgrade to FFmpeg 8.1.2 or later. The fix rejects slice_height values that are not aligned to the chroma vertical subsampling factor (merged in https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159). Until an upgrade is available, rebuild FFmpeg with --disable-decoder=magicyuv, or apply an equivalent guard that returns AVERROR_INVALIDDATA when s->vshift[1] && (s->slice_height & ((1 << s->vshift[1]) - 1)).
https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/ https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159 https://nvd.nist.gov/vuln/detail/CVE-2026-8461