CVE-2026-8461

HIGH

Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-8461 has a selected CVSS score of 8.8 (high); EIP currently links 5 repository PoCs.

Description

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
5

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 18, 2026 · Source: CVE List

Affected products and versions

12
ProductSourceVersion range

FFmpeg

Browse FFmpeg / FFmpeg

Default status: unaffected

CVE ListBefore 8.1.2affected

Red Hat AI Inference Server

Browse Red Hat / Red Hat AI Inference Serverrhaii/vllm-cpu-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat AI Inference Server

Browse Red Hat / Red Hat AI Inference Serverrhaii/vllm-cuda-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat AI Inference Server

Browse Red Hat / Red Hat AI Inference Serverrhaii/vllm-rocm-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux AI (RHEL AI) 3

Browse Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-aws-cuda-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux AI (RHEL AI) 3

Browse Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-azure-cuda-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux AI (RHEL AI) 3

Browse Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-azure-rocm-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux AI (RHEL AI) 3

Browse Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-cuda-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux AI (RHEL AI) 3

Browse Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-gcp-cuda-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux AI (RHEL AI) 3

Browse Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3rhelai3/bootc-rocm-rhel9

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux AI 3.5 for RHEL 9

Browse Red Hat / Red Hat Enterprise Linux AI 3.5 for RHEL 9ffmpeg

Default status: affected

CVE List0:6.1.6-1.el9ai to < *unaffected

Red Hat OpenShift AI (RHOAI)

Browse Red Hat / Red Hat OpenShift AI (RHOAI)rhoai/odh-vllm-gaudi-rhel9

Default status: affected

CVE ListVersion data not supplied

Proofs of concept

5

Repository PoCs

GitHubHORKimhab/CVE-2026-42055Repository PoCby HORKimhab0Not analyzed3 files

5.3 KiB · linked to 14 vulnerabilities

GitHub
PoC details
GitHubanyanything/CVE-2026-8461-PoCRepository PoCby anyanything8Exploit2 files

24.5 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that generates a malicious AVI file to exploit CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder. The script crafts a video file that, when processed by a vulnerable FFmpeg, triggers a heap overflow to overwrite an AVBuffer struct, hijacking its free function pointer to execute an arbitrary shell command via system().

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python script that generates a malicious AVI file to exploit CVE-2026-8461 in FFmpeg. The script's behavior is consistent with a publicly documented exploit chain: it crafts a MagicYUV video file that triggers an out-of-bounds write to hijack an AVBuffer structure and redirect execution to system(). The code includes no hidden or deceptive functionality beyond the stated exploit generation. The README warns the PoC is AI-generated. No backdoor, trojan, or unrelated harmful behavior was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareFFmpeg
Attack typesRemote Code ExecutionHeap Out-of-Bounds Write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script is explicitly designed to generate a malicious media file that, when processed by a vulnerable FFmpeg, triggers a heap out-of-bounds write to hijack control flow and execute an arbitrary shell command. This constitutes exploit code, not merely a scanner or writeup.

exploit_cve_2026_8461.py:3-6exploit_cve_2026_8461.py:9-11exploit_cve_2026_8461.py:35

Requirements

  • ASLR must be disabled on the target system.exploit_cve_2026_8461.py:19
  • The target must use glibc malloc (jemalloc breaks the heap layout).exploit_cve_2026_8461.py:20
  • The attacker must calibrate heap offsets for the specific target FFmpeg build and file path length.exploit_cve_2026_8461.py:21
  • The target must be running a vulnerable version of FFmpeg (before 8.1.2).exploit_cve_2026_8461.py:22

Observed behavior

  • Generates a MagicYUV-encoded AVI file with a crafted odd slice_height that causes an out-of-bounds write in the decoder.exploit_cve_2026_8461.py:54exploit_cve_2026_8461.py:383
  • Uses left-prediction encoding to place a crafted payload on the heap that overwrites an adjacent AVBuffer struct.exploit_cve_2026_8461.py:13-16exploit_cve_2026_8461.py:92-103
  • Overwrites the AVBuffer.free function pointer with the address of system() and sets AVBuffer.opaque to point to an attacker-controlled command string on the heap.exploit_cve_2026_8461.py:225-231
  • When FFmpeg processes the generated AVI file, the corrupted AVBuffer is freed, causing system() to be called with the attacker's command, achieving remote code execution.exploit_cve_2026_8461.py:5-6exploit_cve_2026_8461.py:700
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
OOB Write → AVBuffer.free hijack → system()The script's documented purpose is to generate an AVI file that exploits CVE-2026-8461 for remote code execution. This is the normal behavior of a PoC exploit generator.exploit_cve_2026_8461.py:5-6
Shell Command Execution
system() call with attacker-controlled commandThe exploit payload overwrites AVBuffer.free with the address of system() and sets AVBuffer.opaque to a heap address containing a shell command. This is the intended RCE mechanism of the exploit, not a backdoor in the generator script itself.exploit_cve_2026_8461.py:225-231
Calibration Requirement
ASLR disabled, glibc malloc, calibrated heap offsetsThe script requires specific target conditions (ASLR disabled, known heap layout) to achieve RCE. This is typical for memory corruption exploits and does not indicate a backdoor.exploit_cve_2026_8461.py:18-22
Review boundaries

What the analysis did not establish

  • The evidence consists of the complete source code of the exploit generator and its README. No binary files were present. The analysis is based solely on static review of the provided text; the code was not executed.
  • The exploit requires specific, non-default target conditions (ASLR disabled, glibc malloc, calibrated heap offsets) and is not a universal, turnkey exploit.
  • Only the two text files (README.md and exploit_cve_2026_8461.py) were reviewed. No binary files were present in the evidence.
  • The review does not assess the safety or correctness of the generated AVI file; it only evaluates the PoC generator script for backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubY5neKO/CVE-2026-8461-EXPRepository PoCby Y5neKO15Exploit7 files

555.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full exploit generator for CVE-2026-8461, a heap out-of-bounds write in FFmpeg's MagicYUV decoder. It includes a Python script (exploit_cve_2026_8461.py) that crafts a malicious AVI file to overwrite an AVBuffer function pointer with the address of system(), achieving arbitrary command execution. The repository also contains calibration scripts and a detailed technical writeup.

Backdoor review

No backdoor observed in reviewed code

The repository contains a documented proof-of-concept exploit for CVE-2026-8461, a heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder. The exploit chain uses the vulnerability to overwrite an AVBuffer function pointer with the address of system() and execute an attacker-supplied shell command. All behavior is consistent with the stated exploit goal against the vulnerable FFmpeg target. No concealed backdoor, unrelated payload, or operator-directed harm beyond the declared exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareFFmpeglibavcodec
Attack typesHeap Out-of-Bounds WriteArbitrary Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is classified as an exploit because it contains functional code (exploit_cve_2026_8461.py) designed to generate a malicious input that exercises a vulnerability to achieve arbitrary code execution, not merely detect it. The script's docstring and README explicitly state it is a 'Full RCE Exploit Generator' that implements a chain from OOB Write to system() call.

exploit_cve_2026_8461.py:1-6README.md:1-5

Requirements

  • ASLR must be globally disabled (kernel.randomize_va_space=0) for the exploit's hardcoded addresses to be valid.README.md:47exploit_cve_2026_8461.py:19
  • A calibration step must be performed on the target machine to determine the exact heap layout, including the address of system() and the offset of the AVBuffer struct.README.md:62-81exploit_cve_2026_8461.py:25-28
  • The target must be running a vulnerable version of FFmpeg (≤ 8.0.1) on x86_64 with glibc malloc.CVE-2026-8461_Analysis.md:15-18exploit_cve_2026_8461.py:20

Observed behavior

  • The exploit_cve_2026_8461.py script generates a malicious AVI file. When this file is decoded by a vulnerable FFmpeg, it triggers a 640-byte heap out-of-bounds write.exploit_cve_2026_8461.py:1-6CVE-2026-8461_Analysis.md:3
  • The out-of-bounds write is used to overwrite the 'free' function pointer in an adjacent AVBuffer struct with the address of system(), and the 'opaque' field with a pointer to a shell command string also placed on the heap.exploit_cve_2026_8461.py:192-238CVE-2026-8461_Analysis.md:179-210
  • When the decoded frame is freed, the hijacked function pointer is called, resulting in the execution of the attacker-supplied shell command (e.g., 'id > /tmp/pwned').CVE-2026-8461_Analysis.md:505-512README.md:108-113
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
OOB write → AVBuffer.free hijack → system() callThe exploit generator (exploit_cve_2026_8461.py) builds a crafted AVI file that triggers a heap out-of-bounds write in FFmpeg's MagicYUV decoder, overwrites the AVBuffer.free function pointer with system(), and places a shell command on the heap. When the frame is freed, system(cmd) is called.exploit_cve_2026_8461.py:192-238CVE-2026-8461_Analysis.md:132-210
Command Execution
system("id > /tmp/pwned")The exploit is designed to execute an arbitrary shell command via system(). The README and analysis documents show the expected result: the command executes, then the process crashes due to heap corruption.README.md:88-113CVE-2026-8461_Analysis.md:485-512
Calibration Requirement
ASLR must be disabled (kernel.randomize_va_space=0) and heap layout must be calibrated for the target binary and AVI path.The exploit requires a calibration step to determine the exact heap addresses of system() and the command string, as well as glibc chunk metadata that must be preserved. This is documented as a prerequisite for the exploit to work.README.md:42-48CVE-2026-8461_Analysis.md:277-282
Review boundaries

What the analysis did not establish

  • The evidence includes two calibration scripts (auto_calibrate.py, auto_calibrate_nosym.py) and a binary file (ffmpeg_prod) that are not included in the selected text, limiting full analysis of the calibration process.
  • The exploit is explicitly limited to x86_64 architectures with ASLR disabled, as stated in the documentation.
  • The analysis is based solely on the provided text; the code was not executed, and its reliability or safety is not verified.
  • The evidence packet includes only 4 of 7 files in the repository. Two Python scripts (auto_calibrate.py, auto_calibrate_nosym.py) and one binary file (ffmpeg_prod) were omitted. The binary file was flagged as metadata-only and not analyzed. The omitted scripts are described in the README and analysis documents as calibration tools, but their source code was not reviewed.
  • The repository contains a non-text media file (images/image-20260624151409029.png) that was not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub0xBlackash/CVE-2026-8461Repository PoCby 0xAshwesker5Exploit2 files

9.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that generates a malicious AVI file containing a crafted MagicYUV frame designed to trigger an out-of-bounds write (CVE-2026-8461) in FFmpeg's libavcodec, overwriting an AVBuffer's free function pointer with system() to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python script that generates a malicious AVI file to exploit CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder. The script builds a crafted video frame with a payload designed to overwrite heap metadata and redirect execution to system() with a user-supplied command. All behavior is consistent with the disclosed exploit: the operator provides the command and target addresses, and the script produces an AVI file. No concealed, unrelated, or deceptive actions were found.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareFFmpeglibavcodecMagicYUV decoder
Attack typesOut-of-bounds writeRemote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script is explicitly designed to generate a malicious media file that exploits CVE-2026-8461 to achieve remote code execution by corrupting heap metadata and hijacking a function pointer. It does not merely detect or report the vulnerability; it constructs and outputs an exploit payload.

CVE-2026-8461.py:3CVE-2026-8461.py:60-78CVE-2026-8461.py:150-153

Requirements

  • Target must be running a vulnerable version of FFmpeg (before 8.1.2) with the MagicYUV decoder.README.md:26-28
  • Attacker must know or calibrate target-specific memory addresses (system() and command heap address).CVE-2026-8461.py:40-44
  • Victim must process the generated AVI file with FFmpeg (e.g., ffmpeg -i exploit.avi -f null -).CVE-2026-8461.py:152-153

Observed behavior

  • Constructs a MagicYUV frame with an odd slice_height (31) to trigger an out-of-bounds write.CVE-2026-8461.py:18
  • Builds an out-of-bounds payload that overwrites an AVBuffer structure: sets refcount to 1, replaces the free function pointer with system(), and sets the opaque pointer to a heap address containing the attacker's command.CVE-2026-8461.py:60-78
  • Wraps the exploit frame in a minimal AVI container and writes it to a file.CVE-2026-8461.py:111-129
  • Accepts a shell command and calibration data (system address, command heap address) as command-line arguments.CVE-2026-8461.py:135-138
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
system()The payload overwrites an AVBuffer free function pointer with the address of system() and sets the opaque pointer to a heap address containing the user-supplied command. This is the disclosed RCE mechanism.CVE-2026-8461.py:75-76
User Supplied Input
--cmdThe operator must supply the command to execute via the --cmd argument. The script does not embed or hardcode any command.CVE-2026-8461.py:135
Target Addresses
system_addr, cmd_heap_addrThe operator must supply target-specific addresses (system() and command heap location) either via a calibration JSON file or command-line arguments. Default example addresses are provided but are clearly marked as examples.CVE-2026-8461.py:40-41CVE-2026-8461.py:137-138
Review boundaries

What the analysis did not establish

  • The AVI container construction is incomplete (line 122 notes 'more AVI headers omitted for brevity'), so the generated file may not be a fully valid AVI.
  • The exploit requires target-specific memory addresses (system() and command heap) that are not provided; default values are placeholders and unlikely to work without calibration.
  • The evidence does not include any demonstration or verification that the generated file successfully triggers the vulnerability or achieves code execution.
  • The AVI container creation function (create_avi) contains a comment indicating that some AVI headers are omitted for brevity (line 122). The generated AVI file may be incomplete or non-functional, but this does not introduce backdoor behavior.
  • The review is limited to the supplied text files; no binary files were present.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubray-goldman/ffmpeg-jellyfixRepository PoCby ray-goldman0Writeup9 files

PowerShell · 16.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README for an unofficial Windows FFmpeg 8.1.2 build intended for Jellyfin users. It documents the build's purpose (addressing CVE-2026-8461), contents, build instructions, and licensing. It contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a custom FFmpeg build for Jellyfin. The text provides build instructions, usage notes, and license warnings. No executable code, scripts, or configuration files are included in the reviewed content. There is no indication of concealed behavior, credential theft, persistence, or any other backdoor activity within the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdown
Target softwareFFmpeg
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a documentation file (README.md) that describes a software build. It contains no code that exercises or checks for a vulnerability. It is a substantive technical writeup about the build, not an exploit or scanner.

README.md:1-83

Observed behavior

  • The README describes an unofficial FFmpeg build for Windows, provides build and verification instructions, and notes that the build addresses CVE-2026-8461.README.md:1-83
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Documentation
README.md describes a custom FFmpeg build for JellyfinThe entire reviewed evidence is a documentation file with no executable payload or deceptive instructions.README.md:1-83
Review boundaries

What the analysis did not establish

  • Only the README.md file content was provided; 8 other text files were omitted from the evidence packet.
  • The analysis is based solely on the supplied text; no code execution or binary inspection was performed.
  • Only the README.md file was reviewed; 8 other text files in the repository were omitted from the evidence packet.
  • No binary files were analyzed; the repository may contain compiled executables or scripts not included in this review.
  • The review is limited to the supplied text content and cannot verify the safety of any external build process or downloaded dependencies described in the instructions.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

6