Shell Spawned by FFmpeg/ffprobe (PixelSmash CVE-2026-8461)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•7

Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.