A recently disclosed vulnerability in Home Assistant has unveiled how improper handling of FFmpeg inputs can be exploited to steal sensitive files and ultimately enable root-level command execution on affected systems.
This issue, discovered by security researchers at elttam, highlights the dangers of integrating powerful multimedia tools like FFmpeg into applications without strict input validation.
Home Assistant is a widely used open-source smart home platform that supports a vast ecosystem of devices and services. Its flexibility and local-first architecture have made it a popular choice for privacy-conscious users.
However, its deployment within trusted home networks also makes it an attractive target for attackers seeking lateral movement or full system compromise.
The vulnerability resides in the Wyoming integration, specifically within the “announce” feature used for audio playback. This functionality relies on FFmpeg to process media streams, passing user-supplied input directly as a command argument.
While this is not a classic command injection flaw, it does allow for argument injection, enabling attackers to manipulate how FFmpeg interprets input sources.
Home Assistant FFmpeg Vulnerability
Researchers found that although certain protocols, such as HTTP and HTTPS, were restricted to prevent server-side request forgery, several FFmpeg pseudo-protocols remained permitted.
These include “file:,” “concat:,” and “subfile:,” which can be chained together to create complex input streams. By leveraging these protocols, attackers could bypass validation controls and instruct FFmpeg to read arbitrary local files.
One of the key challenges in exploitation was FFmpeg’s requirement for valid audio input. Directly reading sensitive files, like “/proc/self/environ,” would fail because they lack proper audio headers.
To overcome this limitation, elttam researchers developed a technique that constructs a synthetic audio header by reusing specific byte ranges extracted from an existing binary on the target system.
These fragments were combined using FFmpeg’s pseudo-protocols to create a valid stream, enabling the target file’s contents to be processed and exfiltrated.
By using this method, attackers could retrieve environment variables, including the highly sensitive SUPERVISOR_TOKEN. This token provides privileged access to Home Assistant’s supervisor API, which can be exploited to execute commands as the root user on the host system.
The result is a complete compromise of the Home Assistant instance and potentially the underlying operating system. Successful exploitation requires specific conditions.
The attacker must control a Wyoming Assist satellite that has been paired with the target instance, typically necessitating local network access during setup.
Additionally, a valid Home Assistant API token is needed to trigger the vulnerable announce endpoint. Despite these constraints, the attack can have a significant impact in real-world scenarios, particularly in environments where attackers have already gained limited access.
The issue was patched in Home Assistant Core version 2026.6.2. The fix introduces a strict protocol allowlist for FFmpeg, limiting allowed input sources to safe options such as HTTP, HTTPS, file, TCP, and TLS.
Importantly, the patch ensures that the allowlist is applied before the input argument, preventing any bypasses due to FFmpeg’s argument-parsing behavior.
This vulnerability underscores a broader security lesson: even well-established tools like FFmpeg can become dangerous when integrated without careful input handling.
As smart home platforms continue to expand their capabilities, ensuring secure interactions between components remains critical to preventing complex attack chains.
