CVE-2026-107660 in FFmpeg
Summary
by MITRE • 10/08/2026
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in FFmpeg versions prior to 8.1.3 and the 9.x series before version 9.0.2 represents a critical flaw in the transport layer security implementation, specifically within the tls_open function located in libavformat/tls_mbedtls.c. This defect stems from an improper certificate validation mechanism that fails to enforce hostname verification when the connection target is specified as an IP address literal rather than a domain name. In standard TLS operations, verifying that the server's certificate matches the intended host is essential for preventing man-in-the-middle attacks. However, in this specific code path, the logic bypasses these checks entirely if the URL contains an IP address, effectively treating any validly signed certificate as trustworthy regardless of whether it was issued to a different entity or domain.
From a technical perspective, this flaw allows network attackers positioned within the communication path between the client and server to perform active interception without detection. Because the validation process skips hostname checks for IP-literal URLs, an attacker can present any certificate that is trusted by the system's root store, even if that certificate was issued for a completely unrelated service or domain. This undermines the core security guarantee of TLS, which relies on binding cryptographic identity to specific network endpoints. The absence of this check means that while encryption may still be applied, the authenticity of the peer cannot be verified, leaving the integrity and confidentiality of the data exchange vulnerable to manipulation by malicious intermediaries.
The operational impact of this vulnerability is severe for applications relying on FFmpeg to handle secure media streams over HTTPS, RTMPS, or other TLS-encrypted protocols when accessed via IP addresses. Attackers can intercept these connections to read sensitive content in plaintext after decryption or tamper with the stream data by injecting malicious payloads or altering existing frames without triggering certificate errors that would alert users or applications. This is particularly dangerous in scenarios where media servers are accessed directly via their IP configurations, such as in local network deployments, embedded systems, or automated pipelines that hardcode server addresses for performance or routing reasons. The ability to silently modify streams can lead to data integrity violations, privacy breaches, and potential execution of further attacks if the stream contains executable code or triggers specific decoder behaviors based on manipulated input.
This vulnerability aligns with CWE-295, which describes Improper Certificate Validation, specifically falling under subcategories related to hostname verification failures. In terms of adversary tactics, it facilitates MITM (Man-in-the-Middle) attack techniques documented in the ATT&CK framework, particularly those involving interception and modification of network traffic. To mitigate this risk, organizations must upgrade FFmpeg to version 8.1.3 or later for the 8.x branch, or version 9.0.2 and above for the 9.x branch, where the hostname validation logic has been corrected to apply consistently regardless of whether an IP address or domain name is used in the connection string. Additionally, developers should ensure that their build configurations do not disable strict certificate verification modes and consider implementing Certificate Pinning for high-security applications to provide defense-in-depth against such validation bypasses.