CVE-2026-107675

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107675", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-08T15:11:27.695Z", "datePublished": "2026-10-08T15:28:41.235Z", "dateUpdated": "2026-10-08T18:00:38.446Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:28:41.235Z"}, "datePublic": "2026-09-06T16:21:33.000Z", "title": "FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol", "descriptions": [{"lang": "en", "value": "FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Key Exchange without Entity Authentication", "cweId": "CWE-322", "type": "CWE"}]}], "affected": [{"vendor": "FFmpeg", "product": "FFmpeg", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "9.0.2", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/ffmpeg/ffmpeg", "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.0.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384", "tags": ["patch"]}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce", "tags": ["patch"]}, {"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110", "tags": ["technical-description"]}, {"url": "https://ffmpeg.org/", "tags": ["product"]}, {"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"}], "credits": [{"lang": "en", "value": "Joshua Rogers (AISLE Research)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T18:00:33.282421Z", "id": "CVE-2026-107675", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T18:00:38.446Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107675", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-08T15:11:27.695Z", "datePublished": "2026-10-08T15:28:41.235Z", "dateUpdated": "2026-10-08T18:00:38.446Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:28:41.235Z"}, "datePublic": "2026-09-06T16:21:33.000Z", "title": "FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol", "descriptions": [{"lang": "en", "value": "FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Key Exchange without Entity Authentication", "cweId": "CWE-322", "type": "CWE"}]}], "affected": [{"vendor": "FFmpeg", "product": "FFmpeg", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "9.0.2", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/ffmpeg/ffmpeg", "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.0.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384", "tags": ["patch"]}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce", "tags": ["patch"]}, {"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110", "tags": ["technical-description"]}, {"url": "https://ffmpeg.org/", "tags": ["product"]}, {"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"}], "credits": [{"lang": "en", "value": "Joshua Rogers (AISLE Research)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107675", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T18:00:33.282421Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T18:00:35.480Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/ffmpeg/ffmpeg", "product": "FFmpeg", "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg", "vendor": "FFmpeg", "versions": [{"lessThanOrEqual": "9.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "3022821F-41A7-4B62-809E-BD475556C7DC", "versionEndIncluding": "9.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."}], "id": "CVE-2026-107675", "lastModified": "2026-10-14T23:55:28.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107675", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T18:00:33.282421Z", "version": "2.0.3"}}]}, "published": "2026-10-08T16:17:05.070", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch"], "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://ffmpeg.org/"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-322"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ffmpeg: ffmpeg: Information disclosure via missing SFTP host key verification", "id": "2548038", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548038"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-322", "details": ["A flaw was found in FFmpeg. The libssh-based SFTP (SSH File Transfer Protocol) handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposing user credentials and sensitive media data or allowing the delivery of forged content."], "name": "CVE-2026-107675", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "ffmpeg", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-aws-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-azure-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-azure-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-gcp-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-vllm-gaudi-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-08T15:28:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107675\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107675\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384\nhttps://ffmpeg.org/\nhttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110\nhttps://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.0.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FFmpeg", "source": "cna", "vendor": "FFmpeg"}, "product": "ffmpeg", "vendor": "ffmpeg"}], "created": "2026-10-08T18:00:18.919418+00:00", "updated": "2026-10-08T18:45:17.531578+00:00", "vendors": ["ffmpeg", "ffmpeg$PRODUCT$ffmpeg"]}