FFmpeg libavcodec MagicYUV Decoder Heap Out-of-Bounds Write (PixelSmash)

#!/usr/bin/env bash
# check_cve_2026_8461.sh - Check for CVE-2026-8461 (PixelSmash)
# FFmpeg MagicYUV decoder heap OOB write
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

echo "[*] CVE-2026-8461 (PixelSmash) - FFmpeg MagicYUV Decoder Check"
echo "=============================================================="

# Check if ffmpeg is installed
if ! command -v ffmpeg &>/dev/null; then
  echo "[?] ffmpeg not found in PATH."
  echo "[!] Check for bundled FFmpeg in applications (jellyfin-ffmpeg, etc.)"
  echo "UNKNOWN"
  exit 2
fi

# Get FFmpeg version
FFMPEG_VERSION=$(ffmpeg -version 2>/dev/null | head -1 | grep -oP '\d+\.\d+(\.\d+)?' | head -1)
if [ -z "$FFMPEG_VERSION" ]; then
  echo "[?] Could not parse FFmpeg version."
  echo "UNKNOWN"
  exit 2
fi
echo "[*] FFmpeg version: $FFMPEG_VERSION"

# Check if MagicYUV decoder is enabled
MAGICYUV=$(ffmpeg -decoders 2>/dev/null | grep -i magicyuv || true)
if [ -z "$MAGICYUV" ]; then
  echo "[+] MagicYUV decoder is NOT enabled - not vulnerable to this CVE."
  echo "PATCHED"
  exit 0
fi
echo "[*] MagicYUV decoder is enabled: $MAGICYUV"

# Version comparison function
version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

# Check upstream FFmpeg version (8.1.2+ is patched)
if version_gte "$FFMPEG_VERSION" "8.1.2"; then
  echo "[+] FFmpeg version $FFMPEG_VERSION >= 8.1.2 (upstream fix)."
  echo "PATCHED"
  exit 0
fi

# Check for known distro backport versions
FULL_VERSION=$(ffmpeg -version 2>/dev/null | head -1)
echo "[*] Full version string: $FULL_VERSION"

# Debian trixie backport
if echo "$FULL_VERSION" | grep -q 'deb13'; then
  DEB_VER=$(dpkg -l ffmpeg 2>/dev/null | awk '/^ii/{print $3}' || true)
  if [ -n "$DEB_VER" ] && dpkg --compare-versions "$DEB_VER" ge "7:7.1.5-0+deb13u1" 2>/dev/null; then
    echo "[+] Debian backport $DEB_VER includes the fix."
    echo "PATCHED"
    exit 0
  fi
fi

# Ubuntu ESM backports
if command -v dpkg &>/dev/null; then
  DEB_VER=$(dpkg -l ffmpeg 2>/dev/null | awk '/^ii/{print $3}' || true)
  if [ -n "$DEB_VER" ]; then
    echo "[*] dpkg reports ffmpeg version: $DEB_VER"
    if echo "$DEB_VER" | grep -qP 'esm1[6-9]|esm[2-9]\d'; then
      echo "[+] Ubuntu ESM backport detected - likely patched."
      echo "[!] Verify against advisory: 7:4.4.2-0ubuntu0.22.04.1+esm16 (jammy)"
      echo "[!]                      or: 7:4.2.7-0ubuntu0.1+esm17 (focal)"
      echo "PATCHED"
      exit 0
    fi
  fi
fi

echo "[-] FFmpeg version $FFMPEG_VERSION is VULNERABLE to CVE-2026-8461."
echo "[-] MagicYUV decoder is enabled and version is below 8.1.2."
echo "[-] Upgrade to FFmpeg 8.1.2+ or rebuild with --disable-decoder=magicyuv."
echo "VULNERABLE"
exit 1