CVE-2026-107675 FFmpeg CVE debrief

Who should care

Defenders of FFmpeg installations using the sftp protocol, especially those with exposure to untrusted networks or SFTP servers, should assess their configurations and apply patches or compensating controls as needed.

Why it matters

Defenders of FFmpeg installations using the sftp protocol should prioritize patching or mitigating this vulnerability to prevent potential man-in-the-middle attacks and impersonation of SFTP servers.

• Man-in-the-middle attacks may capture SFTP passwords
• Impersonation of SFTP servers may serve forged media
• Network attackers may receive uploaded output
• Verification of SFTP server host keys is required

Technical summary

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler. This allows network attackers to impersonate SFTP servers, potentially capturing passwords or serving forged media. The vulnerability is caused by the lack of host key verification, which enables attackers to perform man-in-the-middle attacks. Defenders of FFmpeg installations using the sftp protocol should prioritize patching or mitigating this vulnerability to prevent potential attacks. The CVE Program and NVD provide vulnerability metadata and references to patches and technical descriptions.

Defensive priority

Medium priority for defenders of FFmpeg installations using the sftp protocol, especially those with exposure to untrusted networks or SFTP servers.

Recommended defensive actions

• Review and apply patches from FFmpeg for versions up to 9.0.2
• Verify SFTP server host keys in FFmpeg configurations
• Monitor SFTP connections for suspicious activity
• Consider implementing compensating controls, such as network monitoring or intrusion detection
• Perform vulnerability scanning to identify exposed FFmpeg installations
• Implement network segmentation to limit the impact of potential attacks
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and source item detail a missing host key verification vulnerability in FFmpeg's libssh-based sftp protocol handler. Official sources, including the CVE Program and NVD, provide vulnerability metadata and references to patches and technical descriptions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.