PixelSmash CVE-2026-8461 RCE via Nextcloud Movie Preview ffmpeg spawn

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•8

Detects potential remote code execution (RCE) attempts leveraging a vulnerability in the Nextcloud Movie preview provider (CVE-2026-8461). The detection identifies cases where the web server service user (www-data) unexpectedly spawns ffmpeg or ffprobe, followed by the immediate spawning of a command shell from these multimedia processing binaries, which is highly anomalous.