> A victim only has to run ffmpeg -i rtsp://attacker/stream, the most ordinary command imaginable

What about "ls"?

I had to read your comment a couple of times to understand it. I assume you are saying that "/bin/ls" is the "most ordinary command imaginable"? I think your original quote is saying most ordinary when running ffmpeg, which has a famously complex command line interface.