Jellyfin ffprobe Library Scan RCE via CVE-2026-8461 MagicYUV

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•6

Detects Jellyfin's automatic library scan invoking ffprobe with the characteristic command-line fingerprint associated with CVE-2026-8461 exploitation. The MagicYUV heap OOB write fires during metadata extraction of crafted AVI/MKV/MOV files, potentially achieving RCE as the jellyfin service user (uid=115).