Sign In

CVE-2026-107660

ADVISORY - nist

Summary

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.

EPSS Score⁠: 0.00136 (0.030)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-297⁠

Improper Validation of Certificate with Host Mismatch

ADVISORY - redhat

CWE-295⁠

Improper Certificate Validation

Impacted images

Advisories

NIST

CREATED

UPDATED

ADVISORY IDCVE-2026-107660⁠
EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CWE-297⁠

CVSS SCORE

6.3medium

Debian

CREATED

UPDATED

ADVISORY IDCVE-2026-107660⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Ubuntu

CREATED

UPDATED

ADVISORY IDCVE-2026-107660⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Red Hat

CREATED

UPDATED

ADVISORY IDCVE-2026-107660⁠
EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CWE-295⁠

CVSS SCORE

4.8medium

Chainguard

CREATED

UPDATED

ADVISORY ID

CGA-fgww-895x-q353

EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

UPDATED

ADVISORY ID

MINI-fr86-h552-fwwm

EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
RATING UNAVAILABLE FROM ADVISORY