VDB
CVE-2026-107698
CVE-2026-107698
PUBLISHED
CVSS 5.3 MEDIUM
Reported by VulnCheck · Published October 8, 2026
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| FFmpeg | FFmpeg | 0, 8.0 |
| ffmpeg | ffmpeg | 0, 8.0 |
| FFmpeg | FFmpeg | 0, 8.0 |
| chainguard | ffmpeg-6 | 0 |
Timeline
- Oct 8, 2026 CVE Published
- Oct 8, 2026 CVE Updated
- Oct 9, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 15, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
References
- Patch Commit patch
- patch
- Backport to release/7.1 patch
- Backport to release/8.0 patch
- patch
- technical-description
- product
- VulnCheck Advisory: FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling third-party-advisory