CVE-2026-8461 Jellyfin/Emby Spawning Shell via FFmpeg MagicYUV RCE

Ethan Andrews@eandrews

•updated Jun 22, 2026•0•0•11

Detects Jellyfin or Emby media server processes (or their ffprobe/ffmpeg child workers) spawning anomalous shell processes such as /bin/sh or bash, consistent with exploitation of CVE-2026-8461 - a heap OOB write in the FFmpeg MagicYUV decoder that hijacks AVBuffer.free to call system() and fork a shell as the jellyfin service user (uid=115) or www-data.