Shell Spawned by FFmpeg/ffprobe (PixelSmash CVE-2026-8461)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•6

Detects instances where FFmpeg media processing tools (ffmpeg, ffprobe, ffmpegthumbnailer) spawn interactive shell processes (bash, sh, dash, zsh, cmd.exe, powershell.exe, pwsh.exe). This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.