The Rails ImageMagick Flaw Validates remade_ffmpeg_rs

On 4 November 2026 the Rails project shipped 8.1.4.1 and 8.0.5.2, a security release that closes 21 issues. The one that matters for pictures is the Rails ImageMagick flaw, GHSA-f3w6-w445-fwh9, scored 9.8. The Hacker News reported it the same day. The project index is the Rails release note. The critical advisory is GHSA-f3w6-w445-fwh9.

This note is why the Rails ImageMagick flaw validates remade_ffmpeg_rs, and why the same class of flaw keeps arriving. The keyword companion is the pure Rust alternative for FFmpeg. The same season's runtime note is PHP2Shell.

What the 4 November release fixed

The Rails ImageMagick flaw sits in Active Storage, the part of Rails that accepts uploads. ImageMagick chooses a format handler, which it calls a coder, from the file's contents. Some coders act on other files named inside the upload, which means the picture is a set of instructions. Active Storage placed no limit on which coder an upload could select. The server's own ImageMagick policy was the only gate, and Rails says the policies Debian and Ubuntu ship do not close this one.

A scripting coder on the way in

The reported chain reached ImageMagick's MSL coder from an uploaded SVG, as the fix commit is described by Rails and by The Hacker News. MSL is a scripting coder: it reads and writes files named by its script. On apps that store attachments with the Disk service, the Rails ImageMagick flaw can also read any file the app process can read, including secret_key_base and credentials for other systems. Rails rates that 9.8. The issue does not yet have a CVE number. RyotaK of GMO Flatt Security reported it through HackerOne. Rails said one chain was reported, and that it does not assume that chain is the only one. The advisory does not say the flaw has already been exploited.

An app is in scope when three things are true. It uses ImageMagick for Active Storage, which is config.active_storage.variant_processor = :mini_magick, the default for apps still on load_defaults 6.1 or earlier. Its ImageMagick policy does not already block the coders involved. It accepts uploads from people it does not trust. If the setting is absent, the default is mini_magick before Rails 7.0 and libvips from 7.0 on. Every Active Storage before 8.0.5.2 is affected, and so is 8.1 before 8.1.4.1. Series older than 8.0 are unsupported. Rails will not ship fixes for them. Security support for the 8.0 series ends on 7 November 2026, three days after this release.

The FFmpeg name in the same drop

The same two versions fix a second Active Storage issue, GHSA-v924-7rp8-4mxh, scored 8.8. Active Storage handed uploads to ImageMagick and to FFmpeg under temporary names that kept the uploaded file's extension. Those tools can pick a decoder from the extension when the bytes do not declare a format. A person who chose the filename and the declared content type could choose the decoder. Rails' temporary workarounds for this second flaw only change how FFmpeg is called. None of them covers ImageMagick. One release, two media tools, two ways an upload becomes more than a picture.

In July, Rails fixed a different critical Active Storage flaw, CVE-2026-66066, on the libvips path. The Hacker News account is that apps on ImageMagick were outside that July chain. They are inside the Rails ImageMagick flaw. The processor setting is a switch between two C libraries, and both sides have now had a critical month.

Why remade_ffmpeg_rs is the validation

remade_ffmpeg_rs is the Remade with Rust media pipeline. It exists so a product can probe, decode, and encode with the FFmpeg C binary off the hot path. The builder field note is remade_ffmpeg_rs. The deploy pin is the repo landing.

The filename is the bug

GHSA-v924-7rp8-4mxh is a decoder selected by a name the uploader picked. FFmpeg's long menu of demuxers is the same property that makes a crafted extension dangerous. A policy file can deny today's bad names. The next format handler arrives as a new name. remade_ffmpeg_rs takes that C menu off the path the house runs. The Rust codecs beside it, including rusty_jpeg and the WebP alternative, parse the formats they were built to parse. A still crate does not keep a scripting coder that opens other files because a picture asked it to.

The MSL and Ghostscript coders in the Rails ImageMagick flaw are the still-image sibling of that menu. remade_ffmpeg_rs is the moving-picture and sound pipeline, and it does not claim to parse MSL. The validation is the shared shape. A C media tool sits on an untrusted upload and decides what the bytes are allowed to do. ImageMagick decides from content. FFmpeg, in this bug, decides from the filename when the content is quiet. Both decisions happen before the application has looked at the picture.

The house path is a different program

A Rails app that still calls ImageMagick or FFmpeg remains on the advisories. The upgrade is 8.1.4.1 or 8.0.5.2. Apps on mini_magick also need mini_magick 5.1 or newer, or the patched Rails raises an error at boot. The shipped ImageMagick policy has to actually load. An app that replaces MiniMagick's environment after boot, or that uses GraphicsMagick, does not receive that policy. A server policy that allows a coder, including a wildcard allow, overrides the shipped block. If attachments used the Disk service, rotate secret_key_base and the other secrets the process could read. Those steps are the Rails project's, in the release note. They are the right steps for a Rails host.

The house path is a different program. mata.network runs Rust services, described in MATA.NETWORK in the wild. Media on that path is remade_ffmpeg_rs. The program thesis is The Importance of Remade With Rust and rebuilding the foundation of the internet. The band map is Media on Vision.

Why the Rails ImageMagick flaw keeps growing

Count the season. July was libvips on Active Storage. November's Rails ImageMagick flaw is the other processor. The same drop adds the FFmpeg filename bug beside it. Three critical or high media failures, one component, two C libraries, a few months. The fixes are deny-lists: block MSL, block coders that touch other files, block Ghostscript, block filename indirection. ImageMagick's job is to recognize more formats next year. Each new coder is another interpreter on the upload. FFmpeg's job is the same kind of menu, growing on the video and audio side. A deny-list written in November does not name the coder that ships in March.

A policy is a second program

The shipped policy adds to the server policy. It does not replace it. A single allow rule wins over the block. GraphicsMagick never reads an ImageMagick policy. An app that clears the MiniMagick environment never loads the file Rails shipped. That is three ways the fix can be absent on a host that believes it upgraded. Rails also wrote that it will not assume the reported chain is the only one. The growth is already in the advisory text. Unsupported Rails older than 8.0 never receives the policy at all, and 8.0's own security window closes on 7 November 2026.

What a closed menu changes

On the Remade path, an upload is bytes for a decoder that was compiled in, for a format the crate claims. There is no second policy file whose wildcard reopens a scripting coder. There is no temporary filename whose extension picks a demuxer. Rust does not close every parser bug. A bad JPEG can still be a bad JPEG inside rusty_jpeg. The change is the size of the menu, and who is allowed to choose it. The Rails ImageMagick flaw is the menu choosing itself. remade_ffmpeg_rs is the decision to keep a smaller menu, written in Rust, for media on mata.network.

Operators who still run Rails should upgrade this week, before the 8.0 security window ends. Builders choosing the next media stack can start from the remade_ffmpeg_rs field note and leave the C tools that made this release necessary off the upload path.