CVE-2026-107660
4.8 MEDIUMpublic exploit availablePublished 2026-10-08 · Updated 2026-10-14
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-297
Vendors
ffmpeg
Products
ffmpeg
Public exploit & PoC references
All references
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383
- https://ffmpeg.org/
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681
- https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-102669
- MEDIUMCVE-2026-107819PoC
- CRITICALCVE-2026-107938
- LOWCVE-2026-12730
- UNSCOREDCVE-2026-19553PoC
- HIGHCVE-2026-59969
- UNSCOREDCVE-2026-63374PoC
- HIGHCVE-2026-84975PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.