FFmpeg has released a fix for PixelSmash, a vulnerability in its widely-used video decoder that could enable remote code execution on Jellyfin servers and denial-of-service attacks across multiple media applications.
The Vulnerability
PixelSmash is a newly disclosed flaw in FFmpeg's video decoding functionality. The vulnerability poses different threat levels depending on the affected application. On Jellyfin servers, the flaw can be exploited for remote code execution—allowing attackers to execute arbitrary commands with the privileges of the running service.
Other popular applications face denial-of-service risks from the same vulnerability. Affected software includes Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio. A denial-of-service attack could crash these applications or render them temporarily unavailable.
Impact and Scope
FFmpeg is a critical component in the media software ecosystem, used extensively for video processing and playback across countless applications. The vulnerability's presence in a decoder—a core component—means exposure is particularly broad. Any service or application relying on FFmpeg for video handling could potentially be affected.
Users of Jellyfin, a popular self-hosted media server, face the most severe risk. Remote code execution vulnerabilities allow attackers to gain system-level access without authentication, potentially compromising entire systems and stored data.
Remediation
FFmpeg has released patches addressing the PixelSmash flaw. Users and administrators should prioritize updating to the patched version. Application developers and platform maintainers relying on FFmpeg should also push updates to their users.
For Jellyfin administrators, the update is critical given the remote code execution risk. Users of other affected applications should check for available updates to their media software.
Next Steps
Organizations running any of the vulnerable applications should review their systems and apply patches as soon as they become available. Security teams should monitor for any indicators of exploitation in their environments.
The North Carolina Ports Authority confirmed a cyberattack has disrupted IT systems across its major operations. The attack affects Port of Wilmington, Port of Morehead City, and Charlotte Inland Port.
Security researchers have identified a Chinese-linked spyware operation targeting victims across 13 countries, including the United States. The discovery came after operators made a critical operational security mistake.
Artificial intelligence has revealed a long-overlooked browser security vulnerability that enterprises can no longer afford to ignore. Skyhigh Security explains why browsers have become essential control points for managing data, AI interactions, and modern work environments.