VDB
CVE-2026-107660
CVE-2026-107660
PUBLISHED
CVSS 6.3 MEDIUM
Reported by VulnCheck · Published October 8, 2026
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Risk Scores
CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| FFmpeg | FFmpeg | 0, 9.0 |
| wolfi | ffmpeg-8.0 | * |
| chainguard | ffmpeg-8.0 | * |
| chainguard | ffmpeg-6 | * |
| ffmpeg | ffmpeg | 9.0, 0 |
| FFmpeg | FFmpeg | 9.0, 0 |
| chainguard | ffmpeg-fips-7.1 | * |
| chainguard | ffmpeg-fips-8.0 | * |
| chainguard | ffmpeg-7.1 | * |
| wolfi | ffmpeg-7.1 | * |
Timeline
- Oct 8, 2026 Coalition ESS Score
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 14, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
References
- patch
- patch
- patch
- patch
- technical-description
- product
- VulnCheck Advisory: FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts third-party-advisory