CVE-2026-107675

MEDIUM 5.9

FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.

CWE	CWE-322
Vendor	ffmpeg
Product	ffmpeg
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

FFmpeg / FFmpeg

0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384 code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110 ffmpeg.org: https://ffmpeg.org/ vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol

Credits

Joshua Rogers (AISLE Research)