CVE-2026-107660 FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts
Attackers can intercept TLS connections to IP-literal URLs by bypassing hostname verification, allowing them to read and tamper with media streams.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107660?
CVE-2026-107660 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Weakness: CWE-297
Which versions are affected by CVE-2026-107660?
It affects 1 product.
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2026-107660?
Upgrade to a fixed version.
Is CVE-2026-107660 being exploited?
There is no known exploitation of CVE-2026-107660 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2026-107660, ECHO-8ca1-9da1-dd17, GHSA-r4c5-645c-gfxv, MINI-fr86-h552-fwwm, UBUNTU-CVE-2026-107660.