CVE-2026-8461 FFmpeg/ffprobe AVBuffer Hijack Spawning Shell Process

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•5

Detects ffmpeg or ffprobe spawning unexpected child processes such as /bin/sh as a result of the MagicYUV OOB write hijacking the AVBuffer.free function pointer to call system() — a key indicator of CVE-2026-8461 exploitation.