Hole in widely-used FFmpeg codec could crash media servers or enable RCE

A critical vulnerability called PixelSmash (CVE-2026-8461) was found in FFmpeg, a widely-used media processing framework, that can crash applications or enable RCE (remote code execution, where an attacker can run commands on a system they don't own) through a heap out-of-bounds write (a memory safety error where code writes data outside its intended memory region) in the MagicYUV decoder. The bug affects hundreds of applications including media servers, video players, and cloud services, and can be triggered by uploading a malicious media file.