CVE-2026-107660
Description
A flaw was found in ffmpeg. When establishing secure connections using the mbedTLS library, hostname verification is omitted for destinations specified directly by an IP address. A remote network attacker can exploit this flaw by presenting a certificate issued by any trusted Certificate Authority (CA) to intercept encrypted traffic. Successful exploitation allows an attacker to eavesdrop on sensitive communications and tamper with media streams in transit.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires an active man-in-the-middle network position and is restricted to connections established directly to IP-literal endpoints rather than domain names. FFmpeg is not included as a standard core package in base Red Hat Enterprise Linux, though it may be bundled within specialized container images such as Red Hat Enterprise Linux AI. Because typical media streaming workflows rely on fully qualified domain names and trusted network infrastructure, exposure under default deployment models remains limited.
Mitigation
To reduce exposure to this vulnerability, apply the following operational controls:
1. Configure client applications and media ingestion pipelines to connect to streaming endpoints using fully qualified domain names (FQDNs) instead of literal IP addresses. Certificate hostname verification functions as intended when connecting via domain names.
2. Route outbound media traffic through secure, authenticated tunnels (such as a private VPN) or restrict network paths using firewall rules to prevent unauthorized traffic interception.
Caveat: Enforcing FQDN usage requires reliable DNS resolution infrastructure. Network-level isolation does not mitigate attacks if the local network gateway or upstream routing devices are already compromised.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
