Improper Certificate Validation in FFmpeg Affects Security
CVE-2026-107660

6.3MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107660?

An improper certificate validation vulnerability exists in the FFmpeg library, particularly affecting versions before 8.1.3 and 9.x prior to 9.0.2. This flaw resides in the 'tls_open()' function within the 'libavformat/tls_mbedtls.c' file. It allows attackers to bypass hostname checks for IP-address hosts. Consequently, an attacker can exploit this vulnerability to intercept HTTPS, RTMPS, or TLS connections towards IP-literal URLs using any valid CA-issued certificate, facilitating unauthorized access to sensitive streams.

Affected Version(s)

FFmpeg 0 < 8.1.3

FFmpeg 9.0 < 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383
patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6...
patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a1...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
.