CVE-2026-85696: Critical OS Command Injection in SadTalker via ffmpeg Filename Handling — Detection and Remediation Guide

---
title: SadTalker ffmpeg Command Injection — Suspicious Child Process of ffmpeg
description: Detects ffmpeg spawning shell or scripting interpreter child processes, a strong indicator of command injection via filename interpolation as described in CVE-2026-85696. Legitimate ffmpeg never spawns shells.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85696
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/ffmpeg'
      - '/python'
      - '/python3'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Custom wrapper scripts that legitimately invoke ffmpeg alongside other tools (tune by ParentCommandLine)
level: high
---
title: Shell Metacharacters in ffmpeg Command Line (SadTalker CVE-2026-85696)
description: Detects shell injection metacharacter sequences (command chaining, substitution) inside ffmpeg command lines, consistent with audio-filename breakout during SadTalker video muxing.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85696
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/ffmpeg'
  selection_meta:
    CommandLine|contains:
      - '; curl'
      - '; wget'
      - '; bash'
      - '; sh'
      - '$(curl'
      - '$(wget'
      - '`curl'
      - '`wget'
      - '| bash'
      - '| sh'
      - '|bash'
      - '|sh'
      - '; nc'
      - '; chmod'
      - '; base64'
  condition: selection_img and selection_meta
falsepositives:
  - Rare; legitimate ffmpeg invocations do not chain shell commands in filenames
level: critical
---
title: Suspicious File Creation in SadTalker Upload and Result Directories
description: Detects creation of executable or script files in common SadTalker upload/results paths, a post-exploitation artifact of CVE-2026-85696 where attackers drop webshells or payload stagers.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85696
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/SadTalker/results/'
      - '/SadTalker/uploads/'
      - '/sadtalker/results/'
      - '/tmp/sadtalker'
  selection_ext:
    TargetFilename|endswith:
      - '.sh'
      - '.py'
      - '.php'
      - '.elf'
      - '.so'
  condition: selection_path and selection_ext
falsepositives:
  - Developer debugging scripts placed manually in SadTalker directories
level: high

// Hunt 1: ffmpeg or SadTalker python spawning shells/downloaders (CVE-2026-85696)
let suspiciousChildren = dynamic(["/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget", "/bin/nc", "/usr/bin/ncat", "/usr/bin/perl"]);
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("ffmpeg", "python", "python3", "sh", "bash", "curl", "wget", "nc", "perl")
| extend CmdLine = tostring(SyslogMessage)
| where CmdLine has_any ("ffmpeg", "SadTalker", "sadtalker")
   and CmdLine has_any ("; curl", "; wget", "| bash", "| sh", "$(", "`", "; nc", "; chmod", "base64 -d")
| project TimeGenerated, Computer, HostIP, ProcessName, CmdLine, SeverityLevel
| order by TimeGenerated desc;

// Hunt 2: Defender for Endpoint — process tree anomalies under ffmpeg/python on onboarded Linux hosts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("ffmpeg", "python", "python3")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "perl", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- CVE-2026-85696: Hunt for shell children of ffmpeg/python and dropped payloads in SadTalker dirs
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)(sh|bash|dash|curl|wget|nc|ncat|perl|base64)$')
  AND CommandLine =~ '(?i)(; *curl|; *wget|\| *(ba)?sh|\$\(|`|; *nc|base64 -d)'

-- Companion artifact: enumerate recently created script/ELF files in SadTalker paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/**/SadTalker/results/*.sh', '/**/SadTalker/results/*.py', '/**/SadTalker/results/*.elf', '/**/sadtalker/results/*.sh', '/**/sadtalker/uploads/*.sh', '/tmp/sadtalker/**'])
WHERE Mtime > now() - 604800

#!/bin/bash
# CVE-2026-85696 hardening & verification script for SadTalker hosts
set -euo pipefail

# --- 1. Verify whether the service is exposed ---
echo "[*] Checking for SadTalker listeners on network interfaces..."
ss -tlnp | grep -Ei '7860|7861|gradio|sadtalker' || echo "[+] No obvious SadTalker listeners found"

# --- 2. Identify the service account and confirm it is NOT root ---
echo "[*] Checking SadTalker process ownership..."
ps -eo user,pid,cmd | grep -i sadtalker | grep -v grep || echo "[+] SadTalker not currently running"

# --- 3. Create a dedicated unprivileged user if the service runs as root ---
if ps -eo user,cmd | grep -i sadtalker | grep -v grep | grep -q '^root'; then
  echo "[!] SadTalker is running as root. Creating dedicated service account..."
  useradd --system --no-create-home --shell /usr/sbin/nologin sadtalker || true
  echo "[!] Update your systemd unit / container entrypoint to run as 'sadtalker'"
fi

# --- 4. Audit for signs of exploitation: shells/downloaders parented by ffmpeg/python ---
echo "[*] Auditing auditd/syslog for ffmpeg spawning shells (last 7 days)..."
if command -v ausearch >/dev/null 2>&1; then
  ausearch -ts recent -k exec_log 2>/dev/null | grep -E 'ffmpeg.*(curl|wget|bash|sh |nc )' || echo "[+] No matching execve records"
else
  grep -E 'ffmpeg.*(;|\|).*(curl|wget|bash|nc)' /var/log/syslog* 2>/dev/null || echo "[+] No matches in syslog"
fi

# --- 5. Sweep SadTalker working directories for dropped payloads ---
echo "[*] Scanning for script/ELF files in SadTalker results/uploads directories..."
find / -type d -iname 'sadtalker' 2>/dev/null | while read -r dir; do
  find "$dir" -type f \( -name '*.sh' -o -name '*.py' -o -name '*.elf' -o -name '*.php' \) -mtime -7 -ls 2>/dev/null
done

# --- 6. Block outbound egress from the service account (defense in depth) ---
echo "[*] Adding egress restriction for sadtalker user (idempotent)..."
iptables -C OUTPUT -m owner --uid-owner sadtalker -d 10.0.0.0/8 -j ACCEPT 2>/dev/null || \
iptables -A OUTPUT -m owner --uid-owner sadtalker -d 10.0.0.0/8 -j ACCEPT
iptables -C OUTPUT -m owner --uid-owner sadtalker -m conntrack --ctstate ESTABLISHED -j ACCEPT 2>/dev/null || \
iptables -A OUTPUT -m owner --uid-owner sadtalker -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -C OUTPUT -m owner --uid-owner sadtalker -j DROP 2>/dev/null || \
iptables -A OUTPUT -m owner --uid-owner sadtalker -j DROP

echo "[+] Hardening complete. Patch SadTalker upstream code as the primary fix."