Is CVE-2026-107660 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107660?

CVE-2026-107660 has a CVSS v3 severity of MEDIUM (4.8).

Back

CVE-2026-107660

Description

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.