FFmpeg is vulnerable to a Heap Out-of-Bounds Write in the MagicYUV Decoder (PixelSmash)

Summary FFmpeg is vulnerable to a Heap Out-of-Bounds Write in the MagicYUV Decoder (PixelSmash) ## Component ffmpeg (libavcodec/magicyuv.c) ## Affected versions < 8.1.2 ## Description A heap-based out-of-bounds write exists in the MagicYUV decoder (libavcodec/magicyuv.c). magy_decode_frame reads slice_height from the bitstream and validates it only against INT_MAX. When slice_height has low bits that are not aligned to the chroma vertical subsampling factor (vshift), the per-slice chroma destination pointer computed via AV_CEIL_RSHIFT rounds up on every slice, so the cumulative row offset exceeds the chroma plane buffer size allocated by av_image_fill_plane_sizes. A crafted MagicYUV-encoded media file (AVI/MKV/MOV) can therefore write attacker-controlled data past the end of the chroma plane heap buffer when decoded. Under typical glibc heap layouts this can corrupt adjacent heap metadata and function pointers (for example AVBuffer.free), enabling denial of service and, in some environments, remote code execution. The MagicYUV decoder is enabled by default in common FFmpeg builds. ## Vulnerability Mitigations Upgrade to FFmpeg 8.1.2 or later. The fix rejects slice_height values that are not aligned to the chroma vertical subsampling factor (merged in code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159). Until an upgrade is available, rebuild FFmpeg with --disable-decoder=magicyuv, or apply an equivalent guard that returns AVERROR_INVALIDDATA when s->vshift[1] && (s->slice_height & ((1 << s->vshift[1]) - 1)). ## References jfrog.com/blog/pixelsmash-critical-ffmp...ability-turns-media-files-into-weapons code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159 nvd.nist.gov/vuln/detail/CVE-2026-8461