CVE-2026-8461 Zero-Click RCE: Shell Spawned from ffmpeg/ffprobe via Jellyfin/Nextcloud

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

Detects unexpected shell or script interpreter processes (e.g., sh, bash, python, perl, nc, curl, wget) spawned as children of media processing applications like ffmpeg or ffprobe, especially when running under service accounts associated with Jellyfin, Nextcloud, or Emby. This behavior could indicate exploitation of a vulnerability (e.g., CVE-2026-8461 / PixelSmash) allowing arbitrary command execution.