Activity

1. aremishevsky

   changed the title [-]CVE in FFMPEG 8.1.1[/-] [+]CVE-2026-8461 in FFMPEG 8.1.1 (needs an update to 8.1.2)[/+] on Jul 15, 2026
2. MDSALMANSHAMS commented on Jul 19, 2026

   

   MDSALMANSHAMS

   on Jul 19, 2026

   Contributor

   More actions

   CVE-2026-8461 is an out-of-bounds write in ffmpeg's MagicYUV decoder (libavcodec/magicyuv.c, CWE-787, CVSS 8.8), fixed upstream in 8.1.2.

   All seven build Dockerfiles are currently pinned at ARG FFMPEG_VERSION=8.1.1 - manylinux2014 (i686, x86_64, aarch64), manylinux_2_28 (x86_64, aarch64) and musllinux_1_2 (x86_64, aarch64). I'll put up a PR bumping all of them to 8.1.2; I did the 8.1.1 i686 bump in #1233.

   Confirmed ffmpeg-8.1.2.tar.gz is published on ffmpeg.org (8.1.3 is not released), so the existing download URLs resolve unchanged.

   🚀React with 🚀1Reacted by Olexander Remishevsky
3. asmorkalov

   added a commit that references this issue on Jul 24, 2026

   Merge pull request #1249 from MDSALMANSHAMS:bump-ffmpeg-8.1.2-cve-202…

   ...

   This issue will close once commit eb88d91 is merged into the '4.x' branch.

   eb88d91
4. asmorkalov

   closed this as completedin #1249on Jul 24, 2026
5. aremishevsky commented on Jul 29, 2026

   

   aremishevsky

   on Jul 29, 2026

   Author

   More actions

   Hi @asmorkalov , @MDSALMANSHAMS.
   I saw that the new 4.14.0.94 version was published today.
   Could you please publish the latest 5.x version as well?

   
6. MDSALMANSHAMS commented on Jul 30, 2026

   

   MDSALMANSHAMS

   on Jul 30, 2026

   Contributor

   More actions

   Hi @aremishevsky, @asmorkalov — glad the 4.14.0.94 release with the FFmpeg 8.1.2 bump (#1249) is out.

   On the 5.x side: the manylinux and musllinux Dockerfiles there are still pinned to FFMPEG_VERSION=8.1.1, and the build_wheels_manylinux.yml matrix still points at the older :20260531 images, so the 5.x wheels are still built against the FFmpeg version affected by CVE-2026-8461.

   I'll put up a PR against 5.x mirroring #1249 — bump the manylinux/musllinux Dockerfiles to 8.1.2 and point the manylinux DOCKER_IMAGE tags at the :20260725 images (the same 8.1.2 build 4.x now ships). I'm scoping it to the 8.1.1 -> 8.1.2 bump; the 5.x i686 build is on a separate older 5.1.x line, so I'm leaving that out of this change.

   That gets the fix into the branch; the actual 5.x publish is your call whenever you're ready to cut it.