FFmpeg / libavcodec MagicYUV decoder (all versions before 8.1.2)

The MagicYUV decoder splits video frames into independent regions called slices, which can be decoded separately. The flaw exists because the frame allocator and the decoder calculate the height of the chroma plane (a component of colour data in video) differently. That mismatch means the decoder writes one row of pixel data beyond the end of the memory it was allocated — a one-row overflow that is small but reliably exploitable for a crash, and potentially worse under the right conditions.

An attacker crafts a malicious video file in AVI, MKV, or MOV format and delivers it to a target system. The flaw triggers when the file is opened directly, when a file manager generates a thumbnail preview, or when an automated media ingestion workflow — such as Jellyfin's library scan — processes the file automatically. For a denial-of-service (DoS) condition, this is reliable. For remote code execution (RCE) on Jellyfin, researchers demonstrated a full exploit, but this required ASLR (Address Space Layout Randomization — a memory protection that randomises where code is loaded to make exploitation harder) to be disabled, or chaining with a separate vulnerability to bypass it. DoS without ASLR disabled is the more realistic near-term risk for most deployments. A particularly low-friction attack scenario involves seeding a malicious video file via torrent, pointed at a Jellyfin media library — the server's own file monitor then triggers the exploit automatically, with no user action required.

1. Check application logs for FFmpeg or ffprobe crashes, segmentation faults, or unexpected process terminations — particularly during media library scans.
2. Monitor for unusual outbound network connections from your media server process, which could indicate a successful exploit on systems with ASLR disabled.
3. If running Jellyfin, review library scan logs for errors referencing MagicYUV or AVI files added around the time of any suspected incident.

1. Upgrade FFmpeg to version 8.1.2 or later. Jellyfin has already updated its bundled FFmpeg — update Jellyfin itself to get the fix.
2. If you cannot patch immediately, add AVI files containing MagicYUV-encoded video to a blocklist where your application supports it. PhotoPrism is already working on this.
3. Ensure ASLR is enabled on any server running media processing software — this significantly raises the bar for RCE exploitation.