CVE-2026-8461

Description

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

Traduire en français

Produits concernés

• FFmpeg
• Red Hat Enterprise Linux AI 3.5 for RHEL 9
• Red Hat AI Inference Server
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)

Scores CVSS

Faiblesses (CWE)

• CWE-787

Références

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159
• https://access.redhat.com/errata/RHSA-2026:43711
• https://access.redhat.com/security/cve/CVE-2026-8461
• https://bugzilla.redhat.com/show_bug.cgi?id=2490308
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories