PixelSmash Bug in FFmpeg Decoder Opens RCE Path on Jellyfin

A memory corruption bug in FFmpeg's PixletVideo decoder — now tagged 'PixelSmash' by the researcher who reported it — gives attackers a path to remote code execution on Jellyfin media servers under certain configurations, and a reliable denial-of-service primitive against a wider set of downstream applications.

The flaw lives in the decoder for Apple's Pixlet codec, an obscure intermediate format that ships enabled by default in most FFmpeg builds. Attackers trigger it by feeding a crafted media file to any application that hands video off to FFmpeg's libavcodec. That covers a lot of software.

Jellyfin is the headline target. Public-facing instances that allow user uploads or remote library scanning can be reached without authentication in some deployments, which is what elevates this from a parser crash to something worth tracking. Successful exploitation yields code execution in the context of the Jellyfin process — typically the same account that owns the media library and any mounted storage.

Other affected downstream consumers include Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio. For those, the publicly demonstrated impact is denial of service. The researcher has not released a working RCE chain for the broader set, and the exploitability ceiling will depend on how each application sandboxes or constrains the decoder. Treat capability and intent separately here.

No in-the-wild exploitation has been reported. There is no current attribution to a known cluster, and the bug class — heap corruption in a niche multimedia decoder — is the kind of thing that historically gets picked up by commercial offensive vendors before it surfaces in nation-state tooling. Worth watching, not panicking over.

FFmpeg has shipped a fix in mainline. Operators should pull the latest FFmpeg build and rebuild or update any dependent application that statically links or bundles libavcodec. Distributions are staging backports.

Mitigations if you can't patch immediately:

• Disable the Pixlet decoder at build time, or block .mov containers carrying the pxlt fourCC at ingest.
• For Jellyfin specifically, restrict upload permissions and put the server behind authenticated reverse proxy access until the underlying FFmpeg is updated.

A few caveats worth flagging. The RCE path on Jellyfin has been demonstrated in a controlled environment; reliability against hardened deployments with ASLR, modern allocator hardening, and non-root service accounts is an open question. Bundled-FFmpeg applications are the long tail here — anything that vendored an older libavcodec and never updated it stays vulnerable regardless of what mainline ships.

If you run a public Jellyfin instance, this is the patch-this-week category. If you run OBS or Kodi on a workstation, the realistic threat is a malicious file crashing your session, not someone popping a shell. Same bug, very different risk profiles.