CVE-2026-63304 describes an OS command injection vulnerability in WWBN's AVideo product, affecting versions through 29.0. The issue exists in the listFFmpegProcesses() function where user-controlled input is embedded unsafely within single-quoted shell commands. This improper neutralization of special elements enables attackers who can supply a valid encrypted codeToExec payload to escape the intended command context and execute arbitrary operating system commands with the privileges of the web server process.

Successful exploitation allows an attacker to execute arbitrary OS commands on the server running AVideo, potentially leading to full system compromise depending on the web server's privileges. This can result in unauthorized access, data theft, service disruption, or further lateral movement within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the vulnerable function and avoid processing untrusted input in the affected parameter. Monitor vendor channels for updates and apply patches promptly once released.