Post #3645351

RE: https://social.coop/@cwebber/116810673204863384 Every once in a while, we observe flaws in media players that allow exploits to be delivered by video files. These files often get free passes in security gateways. Fortunately, it doesn't work by default. BleepingComputer wrote: the RCE exploit requires ASLR (Address Space Layout Randomization) to be disabled, and that CVE-2026-8461 alone does not bypass this memory protection. In theory, a separate information-disclosure bug in FFmpeg's FlashSV decoder could be chained with PixelSmash to bypass ASLR.