CVE-2026-107660
FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts
FFmpeg FFmpegLibraries & packages
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Text from CVE List
Affected versions 2
- FFmpegaffected: all versions before 8.1.3CVE List
- FFmpegaffected: 9.0 before 9.0.2CVE List
References 7
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383Fixvia CVE List
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0Fixvia CVE List
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29Fixvia CVE List
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549fFixvia CVE List
- vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hostsAdvisoryvia CVE List
- github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681Referencevia CVE List
- ffmpeg.org/Referencevia CVE List