Preliminary research
Your House Has an FFmpeg Problem
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
Home Assistant's Wyoming announce service passes media_id straight to ffmpeg as -i, and its scheme blocklist covers only http/https, letting concat:, file: and subfile: through. Raw files still fail because the command forces PCM transcoding, so the exploit splices four-byte slices of /bin/go2rtc with subfile: and concat: into a valid audio header, appends /proc/self/environ, and streams the file back as audio to the attacker's satellite, leaking SUPERVISOR_TOKEN and root on the host.
Record
- Researcher
- Jia Hao Poh
- Published by
- elttam.com
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Jia Hao Poh, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .