CVE-2026-107698
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
FFmpeg FFmpegLibraries & packages
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
Text from CVE List
Affected versions 2
- FFmpegaffected: all versions before 7.1.4CVE List
- FFmpegaffected: 8.0 before 8.0.2CVE List
References 8
- github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1Fixvia CVE List
- github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9Fixvia CVE List
- github.com/FFmpeg/FFmpeg/commit/7c011995e394Fixvia CVE List
- github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1Fixvia CVE List
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292Fixvia CVE List
- vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handlingAdvisoryvia CVE List
- github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016Referencevia CVE List
- github.com/FFmpeg/FFmpegReferencevia CVE List