An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.
This vulnerability is associated with the file libavcodec/magicyuv.C.
This issue affects FFmpeg before version 8.1.2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Jun 29, 2026 | Jun 18, 2026 |
| Debian | — | Upgrade ffmpeg | Jul 23, 2026 | Jul 23, 2026 |
| Ffmpeg | — | Upgrade to FFmpeg version 8.1.2Upgrade to FFmpeg version 8.0.3Upgrade to FFmpeg version 9.0 | Jun 22, 2026 | Jun 18, 2026 |
| Freebsd | — | Upgrade ffmpeg6Upgrade ffmpegUpgrade ffmpeg4 | Jun 30, 2026 | Jun 25, 2026 |
| Ubuntu | — | Upgrade libavformat-extra58 (Ubuntu Pro)Upgrade libavcodec-extra58 (Ubuntu Pro)Upgrade libavfilter7 (Ubuntu Pro)Upgrade libavcodec58 (Ubuntu Pro)Upgrade libavformat58 (Ubuntu Pro)Upgrade ffmpeg (Ubuntu Pro) | Sep 14, 2026 | Sep 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub