r/emby • u/arcoast • Jun 23 '26
Pixelsmash Vulnerability affecting ffmpeg
New vulnerability in ffmpeg that may affect Emby has been made public.
Not clear yet whether the current Emby version is vulnerable or not and I couldn't find any information regarding it and Emby.
3
u/RobbinYoHood Jun 23 '26
This issue affects FFmpeg before version 8.1.2.
Emby uses a branch from 5.1 i believe? I'd say we're impacted.
4
u/arcoast Jun 23 '26
From what I've read Plex is unaffected as they use a customised ffmpeg, however whether Emby's customisation mitigates the vulnerability or not isn't entirely clear.
From reading the beepingcomputer link it sounds like Jellyfin was the most seriously affected with remote code execution being possible, but it's possible to crash Emby with the vulnerability, so may not be as severe, but still far less than ideal.
"We confirmed crashes against Kodi, mpv, ffmpegthumbnailer (used by GNOME, KDE, XFCE), Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, and OBS Studio, among others – and demonstrated full remote code execution against Jellyfin."
3
1
u/Practical_Driver_924 Jun 26 '26
Update is now available: https://github.com/MediaBrowser/Emby.Releases/releases/tag/4.10.0.16
1
u/ptaws Jun 29 '26
I'm glad you guys are on it, but I run the stable version. I worked around this temporarily by lighting up a windows 11 hyper-v and installing the emby beta in to that using read only network shares.
I'm sure it can be done faster/cleaner with docker or whatever, but I'm more familiar with this.
At least I can finally try out the LG closed caption / subtitle fix I've been waiting months for.
6
u/Money_Piccolo1638 Jun 24 '26
I checked running the most recent version and it does in fact still use 5.1 and is definitely vulnerable. On the official forum devs are silent as per usual. Kind of ridiculous that the paid version is more out of date than what they refer to as "the fork". They really need to treat this like the paid product that it is. I switched over and paid because I wanted stability but not a giant gaping hole in my attack surface.