Harish Kumar 
Security researchers at elttam have disclosed a clever exploitation chain that turned a routine ffmpeg command into a gateway for stealing root-level credentials on Home Assistant installations, the widely used open-source platform powering millions of smart homes worldwide.
The vulnerability, patched in Home Assistant Core version 2026.6.2, didn’t stem from a classic buffer overflow or memory corruption bug.
Instead, it exploited an argument-injection flaw in how Home Assistant’s Wyoming protocol integration passed attacker-controlled input directly to ffmpeg, the open-source media processing tool used across countless applications.
Home Assistant FFmpeg Flaw
The flaw lived in Home Assistant’s assist_satellite.py module, which handles voice announcements for Wyoming-compatible smart speakers. When a satellite device receives an announcement, Home Assistant spawns an ffmpeg subprocess to convert the audio, passing the media_id parameter directly as the -i (input) argument.
While Home Assistant blocked obvious http and https requests pointing back at itself, it failed to blocklist ffmpeg’s lesser-known pseudo-protocols: file:, concat:, and subfile:. These let researchers reference local files and even splice together byte ranges from different files into a single input stream.
The catch: ffmpeg refuses to process a file lacking valid audio headers, so a target like /proc/self/environ which stores environment variables including the sensitive SUPERVISOR_TOKEN couldn’t be read directly.
Researchers solved this by scanning /bin/go2rtc, a binary present by default on Home Assistant OS, for scattered byte sequences that, when stitched together in a specific order, formed a valid audio container header.
Using chained subfile: and concat: protocol strings, they assembled this synthetic header and appended the real target file at the end of the chain.
Ffmpeg accepted the crafted input as legitimate audio, transcoded it, and streamed the target file’s contents, including the coveted SUPERVISOR_TOKEN to an attacker-controlled Wyoming satellite over the network.
Exploitation wasn’t trivial. An attacker needed a rogue Wyoming satellite paired with the target Home Assistant instance via mDNS discovery, which required initial local network access and a valid Home Assistant API token to trigger the announce service. Once paired, however, subsequent exploitation could occur remotely if Home Assistant had internet access.
With the stolen SUPERVISOR_TOKEN In hand, attackers could abuse Home Assistant’s Supervisor API to execute root-level commands on the host, effectively taking full control of the smart home hub.
Home Assistant’s patch introduced ffmpeg’s -protocol_whitelist flag, restricting allowed input protocols to http,https,file,tcp,tls and critically placing this flag before the -i argument, since ffmpeg applies options sequentially to the next specified file. Developers also added a unit test to verify the position of the whitelist argument.
Despite closing this specific attack path, elttam noted the underlying pattern feeding unsanitized user input into command-line arguments remains risky and could resurface elsewhere without stricter input sanitization.
This case underscores a broader lesson for the security community: vulnerabilities don’t always originate in the open-source dependency itself.
Sometimes they emerge from how applications wire that dependency into their architecture. As researchers increasingly scrutinize projects like ffmpeg for memory-safety bugs, this disclosure suggests equal attention is needed for integration-layer misuse across the broader OSS ecosystem.
About the Author
Kiran 
