Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

MagicYUV is a lossless intermediate codec used mostly in video editing workflows — niche, but FFmpeg ships a decoder for it and that decoder is enabled by default in every standard build. The bug is a classic CWE-787 heap out-of-bounds write: when the slice_height field in a MagicYUV bitstream is odd, the decoder's row-stride math goes negative-or-misaligned and the chroma plane reconstruction loop writes past the allocated plane buffer. Affected range covers FFmpeg n4.4 through n7.1.x and n8.0 pre-fix, plus every distro and SDK that statically links libavcodec (Chromium-derived browsers ship their own fork — check separately).

Vendor's HIGH/8.8 is defensible but slightly optimistic on the user-interaction assumption. The CVSS vector says UI:R, which is true for desktop media players but false for any server-side pipeline that auto-transcodes uploaded video — and that's where FFmpeg lives in the enterprise. We hold the severity at HIGH and trim the score modestly because MagicYUV is rare enough that drive-by content delivery is unlikely, but the server-side transcoder path is fully unattended and that's the realistic blast vector.

Why this verdict

• Universal dependency: libavcodec is embedded in transcoders, thumbnailers, browsers, media players, and dozens of SaaS upload pipelines — installed base is effectively the whole internet's media plane.
• UI:R is a fiction on servers: any pipeline that auto-decodes uploads (UGC platforms, e-commerce product video, KYC liveness, CCTV ingest) satisfies the precondition without a human in the loop, neutralizing the vendor's primary friction assumption.
• Role multiplier — transcoding worker: if a worker is compromised, blast radius typically stops at the sandbox/container layer in mature pipelines but reaches object-storage credentials and the queue in immature ones. Not fleet-scale, not identity-scale → does not floor at CRITICAL.
• Role multiplier — desktop player: real UI:R, low yield against modern sandboxed players (mpv-Flatpak, VLC-Defender ASR), and MagicYUV is an unfamiliar codec a user is unlikely to receive organically.
• Friction adjustments: obscure codec (-), no weaponized PoC yet (-), heap hardening on modern targets (-), but offset by zero-auth server path (+) and decoder enabled by default (+) — net: hold at HIGH, trim score from 8.8 to 7.4.

Why not higher?

Not CRITICAL because libavcodec is not a high-value-role component in the canonical sense — it does not run as a domain controller, hypervisor, IdP, or kernel-mode agent, and a successful RCE on a transcoding worker is typically contained to that sandboxed job. No KEV listing, no public weaponized exploit, and the obscurity of MagicYUV means broad opportunistic exploitation is unlikely in the near term.

Why not lower?

Not MEDIUM because the server-side transcoding path is a real, unattended RCE primitive on a component that processes attacker-controlled input by design. Any UGC platform, social network, or media SaaS using vanilla ffmpeg for ingest is exposed without user interaction, and the heap-write primitive is controllable enough that weaponization is a question of *when*, not *if*.

1. Disable the MagicYUV decoder in transcoding pipelines — Rebuild ffmpeg with --disable-decoder=magicyuv or pass -vn / explicit codec allowlist (-c:v h264,hevc,vp9,av1) to reject MagicYUV at the command line. Deploy within 30 days per noisgate mitigation SLA for HIGH; this kills the attack surface without waiting for the package update.
2. Sandbox the ffmpeg child process — Run transcoding under gVisor, Firecracker, bubblewrap, or a per-job container with no network egress, no IMDS reach, and no mounted secrets. This contains a successful exploit to a disposable jail and is the most durable control against the *next* libavcodec CVE too. Implement within 30 days.
3. Enforce codec allowlisting at the upload tier — Probe uploaded files with ffprobe -show_streams and reject any that report codec_name=magicyuv before they reach the transcoder. Cheap, fast, and survives container/extension mismatches.
4. Patch to FFmpeg n8.0.1 / n7.1.2 / n6.1.4 — Remediation — must land within 180 days per noisgate remediation SLA for HIGH. Rebuild any internal images that statically link libavcodec; do not assume apt update covers vendored copies in Electron, OBS bundles, or custom containers.
5. Inventory libavcodec usage via SBOM scan — Run Syft/Grype or Trivy against all container images and host packages to find vendored copies of FFmpeg ≤ n8.0 / n7.1.1 / n6.1.3. Static-linked binaries will not be caught by OS package managers.

Run on every Linux host or container image that may bundle ffmpeg. Invoke as ./check-cve-2026-8461.sh (no args) on the target. Requires read access to ffmpeg in $PATH plus any vendored copies you pass via FFMPEG_PATHS="/opt/app/bin/ffmpeg /usr/local/bin/ffmpeg". No root required.

#!/usr/bin/env bash
# check-cve-2026-8461.sh
# Detect FFmpeg builds vulnerable to MagicYUV heap OOB write (CVE-2026-8461)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -u

FIXED_8x="8.0.1"
FIXED_7x="7.1.2"
FIXED_6x="6.1.4"

verdict="PATCHED"
any_found=0

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

check_binary() {
  local bin="$1"
  [ -x "$bin" ] || return
  any_found=1
  local ver
  ver=$("$bin" -version 2>/dev/null | head -n1 | awk '{print $3}' | sed 's/^n//;s/-.*//')
  if [ -z "$ver" ]; then
    echo "[?] $bin : could not parse version"
    verdict="UNKNOWN"
    return
  fi
  local major="${ver%%.*}"
  local fixed=""
  case "$major" in
    8) fixed="$FIXED_8x" ;;
    7) fixed="$FIXED_7x" ;;
    6) fixed="$FIXED_6x" ;;
    4|5) echo "[!] $bin : $ver (EOL branch, treat as VULNERABLE)"; verdict="VULNERABLE"; return ;;
    *) echo "[?] $bin : $ver (unknown branch)"; verdict="UNKNOWN"; return ;;
  esac
  if version_ge "$ver" "$fixed"; then
    echo "[+] $bin : $ver  (fixed, >= $fixed)"
  else
    echo "[!] $bin : $ver  (VULNERABLE, needs $fixed)"
    verdict="VULNERABLE"
  fi
  # confirm magicyuv decoder is compiled in
  if "$bin" -hide_banner -decoders 2>/dev/null | grep -q ' magicyuv '; then
    echo "    -> magicyuv decoder is ENABLED"
  else
    echo "    -> magicyuv decoder is disabled (mitigated)"
  fi
}

# default search
for b in $(command -v ffmpeg 2>/dev/null) /usr/bin/ffmpeg /usr/local/bin/ffmpeg /opt/ffmpeg/bin/ffmpeg; do
  [ -n "$b" ] && check_binary "$b"
done

# user-supplied extra paths
for b in ${FFMPEG_PATHS:-}; do
  check_binary "$b"
done

if [ "$any_found" -eq 0 ]; then
  echo "UNKNOWN: no ffmpeg binary found on PATH or in standard locations"
  exit 2
fi

echo "RESULT: $verdict"
case "$verdict" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. FFmpeg security advisories
2. FFmpeg git log — libavcodec/magicyuv
3. NVD entry (CVE-2026-8461)
4. MITRE CVE record
5. Google OSS-Fuzz issue tracker
6. CWE-787 — Out-of-bounds Write
7. Debian security tracker — ffmpeg
8. CISA KEV catalog