Missing Host Key Verification in FFmpeg SFTP Protocol Handler

CVE-2026-107675

What is CVE-2026-107675?

FFmpeg versions up to 9.0.2 are affected by a vulnerability in the libssh-based SFTP protocol handler, which lacks proper host key verification. This flaw enables network attackers to execute man-in-the-middle attacks, DNS or ARP spoofing, potentially capturing sensitive information such as passwords embedded in SFTP URLs. Furthermore, malicious actors could serve counterfeit media or intercept uploaded files. Users of FFmpeg are urged to update to secure versions that address these vulnerabilities.

References