What is CVE-2026-107675?

CVE-2026-107675 is a medium-severity vulnerability in Ffmpeg, classified under Key Exchange without Entity Authentication. CVSS score: 5.9/10. Published 2026-10-08.

How severe is CVE-2026-107675?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Ffmpeg

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.

Published 2026-10-08 · last modified 2026-10-08.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Ffmpeg

Weakness classification (CWE)

CWE-322 — Key Exchange without Entity Authentication

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384 (patch)
code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce (patch)
github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c (technical-description)
ffmpeg.org/ (product)
www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verifica… (third-party-advisory)

Frequently asked questions

What is CVE-2026-107675?: CVE-2026-107675 is a medium-severity vulnerability in Ffmpeg, classified under Key Exchange without Entity Authentication. CVSS score: 5.9/10. Published 2026-10-08.
How severe is CVE-2026-107675?: Medium severity. CVSS v3 base score is 5.9 out of 10.