CVE-2026-8461 FFmpeg AVBuffer Hijack: Shell Spawned from ffmpeg/ffprobe

Ibrahim Saud@tektrix

•updated Jun 23, 2026•2•0•8

Detects the spawning of shell processes (sh, bash, dash, zsh, ksh) as children of ffmpeg, ffprobe, jellyfin-ffmpeg, or emby-ffmpeg. This behavior is indicative of a successful AVBuffer.free pointer hijack vulnerability (CVE-2026-8461, also known as PixelSmash) being exploited to achieve arbitrary command execution. The rule specifically looks for these parent processes spawning shell children, or if the child process command line contains common shell paths or network-related commands, and filters for specific user accounts often associated with media servers or generic system accounts.