CVE-2026-8461
HIGH 8.8EPSS 1.6%
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 1.57% chance of exploitation in the next 30 days, 74th percentile
- Published
- 2026-06-18
- Updated
- 2026-07-23
Proof-of-concept exploits (4)
- Y5neKO/CVE-2026-8461-EXP15★ · 2026-06-24
- 0xBlackash/CVE-2026-84615★ · 2026-06-26
- anyanything/CVE-2026-8461-PoC8★ · 2026-06-23
- HORKimhab/CVE-2026-84611★ · 2026-06-24