CVE-2026-107660
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Risk Assessment
The organization is exposed to man-in-the-middle attacks where an attacker can eavesdrop on and modify transmitted media streams or data sent over TLS connections to IP addresses. This may lead to data leakage or injection of malicious content.
Recommendation
Update FFmpeg to version 8.1.3 or 9.0.2 (or later) to eliminate the vulnerability. Until patched, avoid connecting via TLS to URLs containing IP literals.
Other vulnerabilities in FFmpeg
See all- CVE-2017-15672High
The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.
- CVE-2017-14767High
The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before version 3.3.4 mishandles empty sprop-parameter-sets values, allowing remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
- CVE-2017-14225High
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, leading to a NULL pointer dereference in the avcodec_string function in libavcodec/utils.c.
- CVE-2012-2805High
Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.
- CVE-2017-11719High
The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg versions 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.
- CVE-2017-11665High
The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service via a crafted stream, leading to segmentation violation and application crash.
- CVE-2017-9996High
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg before versions 2.8.12, 3.0.8, 3.1.8, 3.2.5, and 3.3.1 does not exclude the CHUNKY format, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2017-9995High
In libavcodec/scpr.c in FFmpeg version 3.3 and earlier, before version 3.3.1, height and width data is not properly validated, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2017-9993High
FFmpeg versions before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 do not properly restrict HTTP Live Streaming filename extensions and demuxer names, allowing attackers to read arbitrary files via crafted playlist data.
- CVE-2017-9992High
A heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Original NVD description (English source)
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS