CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
Network attackers can bypass SSH host key verification in FFmpeg's SFTP handler to intercept credentials or serve forged media via man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-107675?
CVE-2026-107675 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
Weakness: CWE-322
Which versions are affected by CVE-2026-107675?
It affects 1 product.
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2026-107675?
Apply the vendor's patch.
Is CVE-2026-107675 being exploited?
There is no known exploitation of CVE-2026-107675 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2026-107675, ECHO-2c52-7488-bb4f, GHSA-vv62-hhh4-f6vv, UBUNTU-CVE-2026-107675.