PixelSmash CVE-2026-8461 AVBuffer.free Hijack RCE via FFmpeg/Jellyfin

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects potential exploitation of CVE-2026-8461 (PixelSmash) where an attacker hijacks the AVBuffer.free function pointer in media processing software (ffmpeg, ffprobe, etc.) to trigger arbitrary code execution via a spawned shell process.