CVE-2026-107675 — FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. …
Published: 2026-10-08 · CVSS: 6.0 · CVSS 4.0
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7