mcp-ffmpeg-helper EUVD-2026-65092

Exploitation requires local access to the system running mcp-ffmpeg-helper (AV:L) and at least a low-privilege user account capable of invoking the tool's MCP interface (PR:L). The attacker must specifically be able to control the format argument passed to the handleToolCall function in src/tools/handlers.ts - this means access to the MCP client interface or direct invocation of the tool handler. No network-based or unauthenticated remote exploitation path is present. Exploitation is limited by the local attack vector requirement, meaning remote, unauthenticated attackers cannot exploit this vulnerability without first gaining local system access through another means. The absence of any required special configuration or non-default feature means that any local low-privilege user on a system where mcp-ffmpeg-helper is installed and running can attempt exploitation.

The CVSS 4.0 score of 4.8 (Medium) with E:P (exploit maturity: proof-of-concept) accurately reflects the constrained threat model. AV:L requires physical or authenticated local access, which is the primary risk limiter here - this cannot be triggered remotely. PR:L confirms at least a low-privilege local account is needed. The vulnerable/subsequent-system impact metrics (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) indicate modest, bounded impact with no scope change to adjacent systems. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically; however, the combination of a public PoC and an unresponsive vendor warrants attention from organizations actively using this tool. KEV status is negative, consistent with the local-only attack surface making widespread automated exploitation impractical. The absence of any vendor patch or response elevates urgency for current users despite the moderate CVSS rating - the real risk is low for most environments given product rarity, but zero for those not running the tool.

A low-privilege local user on a system running mcp-ffmpeg-helper invokes the handleToolCall function with a crafted format argument containing shell metacharacters (e.g., semicolons, backticks, or pipe characters) to break out of the intended ffmpeg command context. The injected payload executes in the process's security context, enabling file read/write or lateral movement within the system's permission boundaries. Publicly available exploit code via GitHub issue #6 lowers the barrier to exploitation for any attacker with local access.