PixelSmash CVE-2026-8461 C2 Callback from Jellyfin or Nextcloud After FFmpeg RCE

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•12

Detects anomalous outbound network connections initiated by media server processes (Jellyfin, FFmpeg, or Nextcloud) immediately following an inbound video file upload (AVI) to the media server's API, indicative of post-exploitation activity related to the PixelSmash (CVE-2026-8461) heap out-of-bounds write vulnerability.