CVE-2026-8461: Turns Video into a Host for Remote Code Execution (ffmpeg Pixel Smash)

[PrismLogic2026]

Hello everybody,

since there was a big security vulverability discovered recently in ffmpeg and the article on jfrog explicitly mentiones OBS as affected, I would like to ask if the current OBS version has the fixed ffmpeg included.
I've tried to find it out by myself, but I couldn't find the source to that. I also couldn't find any other discussion on GitHub or the OBS forum concerning Pixel Smash.

Best regards

[derrod]

OBS 32.2 ships with FFmpeg 8.1.2, which includes a fix for the bug.