OBS Studio CVE-2026-8461 MagicYUV Crash and Child Process Spawn
Detects OBS Studio (obs64.exe or obs) crashing or spawning unexpected child processes (sh, bash, cmd.exe, powershell.exe) which could indicate exploitation of a vulnerability, such as the libavcodec MagicYUV decoder vulnerability when processing AVI, MKV, or MOV files.
Microsoft Sentinel (KQL)

