CVE-2026-107660
Medium
Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
SeverityMedium
CVSS4.8
Exploit probability—
ProductFfmpeg
PublishedOct 8, 2026
First seenOct 8, 2026
Weakness typeCWE-297CWE-297
How to fix
Update
- ffmpeg ffmpeg8.1.3, 9.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ffmpeg ffmpeg | v < 8.1.3, 9.0 ≤ v < 9.0.2 | 8.1.3, 9.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.