Jellyfin FFprobe Exploit Behavior (PixelSmash CVE-2026-8461)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•6

Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.