Vulnerability in Ffmpeg
CVE-2026-107660
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383 (patch)
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0 (patch)
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29 (patch)
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f (patch)
- github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c (technical-description)
- ffmpeg.org/ (product)
- www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-h… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-107660?
- CVE-2026-107660 is a medium-severity vulnerability in Ffmpeg, classified under Improper Validation of Certificate with Host Mismatch. CVSS score: 4.8/10. Published 2026-10-08.
- How severe is CVE-2026-107660?
- Medium severity. CVSS v3 base score is 4.8 out of 10.