CVE-2026-107675 in FFmpeg
Summary
by MITRE • 10/08/2026
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The identified vulnerability resides within the Secure File Transfer Protocol (SFTP) handler of FFmpeg versions up to 9.0.2, specifically affecting components that utilize libssh for network communication. This flaw is classified as a missing host key verification issue, which fundamentally undermines the integrity and authenticity guarantees provided by SSH-based protocols. In standard secure communications, client applications must verify the identity of the remote server against known trusted keys or certificates to prevent impersonation attacks. However, in this implementation, FFmpeg fails to perform adequate validation of the SFTP server's host key during the initial handshake process. This omission creates a critical security gap that allows malicious actors on the network path to intercept and manipulate traffic without triggering any warnings or errors within the application logic.
The operational impact of this vulnerability is severe due to its susceptibility to man-in-the-middle, DNS spoofing, and ARP spoofing attacks. An attacker positioned between the FFmpeg client and the legitimate SFTP server can intercept connection requests and present a forged identity. Because the client does not verify that the presented host key matches an expected or previously trusted value, it accepts the malicious endpoint as authentic. This enables several distinct attack vectors depending on the specific operation being performed by FFmpeg. When retrieving media files via sftp URLs, attackers can serve tampered or completely fabricated media content to the victim application. Conversely, when uploading data, the attacker can receive sensitive output that was intended for a legitimate server. Most critically, if authentication credentials are transmitted within the SFTP URL structure as is sometimes done in legacy configurations, these passwords can be captured directly by the impersonating server, leading to credential compromise and potential unauthorized access to downstream systems.
From a classification perspective, this vulnerability aligns with CWE-295 Improper Certificate Validation, specifically regarding the failure to validate host identity during TLS or SSH handshakes. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts if credential harvesting is successful, and T1499 Endpoint Denial of Service if forged media causes application instability. The lack of server authentication violates core principles of secure software design where trust must be explicitly established rather than assumed by default. This type of flaw is particularly dangerous in automated pipelines or background processes where user interaction for manual verification is not possible, allowing the attack to proceed silently without alerting system administrators or end-users.
Mitigation strategies should focus on immediate version updates and architectural adjustments. The primary remediation is upgrading FFmpeg to a version later than 9.0.2 where this host key verification logic has been corrected. For environments that cannot immediately upgrade, it is imperative to avoid using sftp URLs with embedded credentials in automated scripts or applications. Instead, administrators should configure SSH keys for authentication and ensure that the underlying libssh library used by FFmpeg is configured to enforce strict host key checking policies. Additionally, network-level controls such as DNSSEC can help mitigate DNS spoofing attempts, while ARP inspection features on switches can reduce the risk of local network man-in-the-middle attacks. Long-term resilience requires ensuring that all multimedia processing tools are integrated into a secure software supply chain with regular vulnerability scanning and patch management cycles to address similar deficiencies in other protocol handlers.