FFmpeg's MagicYUV decoder has a critical buffer overflow vulnerability (CVE-2026-8461) that can execute arbitrary code when processing malicious video files—affecting any software that generates thumbnails from media, including file managers and Mastodon servers. The attack requires ASLR to be disabled to work reliably, making it less dangerous on modern Linux systems where ASLR is typically enabled, though denial-of-service attacks work regardless. The author demonstrates domain expertise by noting their initial framing overstated the risk based on press release hype, then correcting it with actual technical limitations from research.