CVE-2026-107675: FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FFmpeg deployments through 9.0.2 are potentially exposed when they use the libssh-based sftp protocol handler to connect to SFTP URLs. The provided information does not state whether other SFTP implementations or configurations are affected.
What access does an attacker need to exploit this?
An attacker needs the ability to impersonate or intercept the intended SFTP server, such as through a man-in-the-middle position, DNS spoofing, or ARP spoofing. The attack does not require attacker privileges on the affected FFmpeg system.
What could an attacker gain or change through exploitation?
An attacker may capture passwords supplied in SFTP URLs, provide forged media in place of expected content, or receive output uploaded by FFmpeg to the impersonated SFTP server.