CVE-2026-107675
Description
A flaw was found in FFmpeg. The libssh-based SFTP (SSH File Transfer Protocol) handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposing user credentials and sensitive media data or allowing the delivery of forged content.
Statement
This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires an active adversary in a man-in-the-middle network position and is constrained to non-default workflows utilizing SFTP endpoints. Red Hat environments predominantly utilize FFmpeg for local media processing and transformation rather than direct remote transfers over SFTP. Consequently, an attacker can only intercept credentials or manipulate transmitted media if an application or user is actively coerced into connecting to a spoofed remote server.
Mitigation
Avoid transferring or streaming remote media over SFTP directly within FFmpeg. Instead, retrieve files prior to processing using standard utilities that enforce SSH host key validation, such as OpenSSH `scp` or `sftp`.
When running FFmpeg from the command line, restrict allowed network protocols to disallow the SFTP handler:
ffmpeg -protocol_whitelist "file,http,https,tcp,tls" -i <input> <output>
Caveats: Restricting protocols via command-line arguments only affects CLI executions. Applications embedding FFmpeg libraries directly must sanitize input URLs to block SFTP schemes or configure protocol allowlists through the library API.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
No authentication takes place in this process, bypassing an assumed protection of encryption.
Confidentiality
Technical Impact: Read Application Data
The encrypted communication between a user and a trusted host may be subject to sniffing by any actor in the communication path.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
