CVE-2026-8461
HIGH EPSS 30.4%
Published Jun 18, 20261w ago · Modified Jun 22, 20261w ago
8.8 CVSS 3.1
Published Jun 18, 2026 1w ago
Last Modified Jun 22, 2026 1w ago
Description
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
30.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-787 Out-of-bounds Write Memory Safety
References 1
- code.ffmpeg.org https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.