The Day FFmpeg Stopped: A Post-Mortem That Could Happen to You

Описание и применение

В 2026 году CVE‑2026‑8461 в декодере MagicYUV FFmpeg привёл к повреждению видео и потенциальному удалённому выполнению кода, подчёркивая уязвимость проекта, поддерживаемого добровольцами, и необходимость устойчивого финансирования.

Задача

A heap out‑of‑bounds write in FFmpeg’s MagicYUV decoder (CVE‑2026‑8461) caused corrupted video output and potential remote code execution, exposing a large ecosystem of dependent applications.

Результат

The CVE was patched, but the event exposed the fragility of FFmpeg’s volunteer-driven maintenance model and underscored the necessity for sustainable funding and efficient triage processes.

Рабочий процесс

• 1. JFrog security researchers discovered a rounding mismatch in MagicYUV.
• 2. They reported the flaw and provided a reproducer.
• 3. FFmpeg maintainers triaged, reproduced, and fixed the issue.
• 4. The patch was merged into FFmpeg 8.1.2.
• 5. The incident prompted discussion on funding models and triage workload.

Доказательства

CVE-2026-8461, nicknamed PixelSmash, CVSS 8.8. It's in libavcodec — the core decode/encode library of FFmpeg.

Источник

The fix landed in FFmpeg 8.1.2.

Источник

Germany's Sovereign Tech Fund had provided €157,580 for 2024–2025 — FFmpeg's first governmental sponsorship.

Источник

Google's AI-powered security tools began flooding FFmpeg with automated vulnerability reports.

Источник