CVE-2026-8461 libavcodec MagicYUV RCE via Media/ML Pipeline Process Spawn

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•2

Detects unexpected shell or suspicious utility execution as a child process of media processing or machine learning pipeline services (e.g., ffmpeg, ffprobe, Jellyfin, Nextcloud, Immich, PhotoPrism, vLLM). This behavior can indicate exploitation of vulnerabilities like CVE-2026-8461 (PixelSmash) or other forms of arbitrary code execution, especially when combined with reverse shell indicators or execution by service accounts.