AIKIDO-2026-686624

TL;DR

The package bundles a precompiled FFmpeg whose MagicYUV decoder in libavcodec/magicyuv.c reads a slice_height from the bitstream that is not aligned to the chroma vertical subsampling. Because the frame allocator and the decoder compute chroma plane heights differently, decoding a crafted MagicYUV stream carried in an AVI, MKV, or MOV container writes a row of chroma data past the end of the allocated heap buffer. The resulting memory corruption can crash the process and, under favorable conditions, be escalated to remote code execution. The fix rebuilds the bundled FFmpeg on a release that rejects chroma-misaligned slice heights and adds bounds checks in the slice and median-prediction path.