Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107698FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling

Medium 5.4

In plain English

A medium-severity server-side request forgery in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ffmpeg	7:5.1.9-0+deb12u1	DEBIAN-CVE-2026-107698
Debian:13	ffmpeg	7:7.1.5-0+deb13u1	DEBIAN-CVE-2026-107698
Debian:14	ffmpeg	7:8.1-1	DEBIAN-CVE-2026-107698
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-107698

Affected products (as reported)

Vendor	Product	Versions
FFmpeg	FFmpeg	0 – before 7.1.48.0 – before 8.0.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

Patch Commit patch
https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9 patch
Backport to release/7.1 patch
Backport to release/8.0 patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292 patch
https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016 technical-description
https://github.com/FFmpeg/FFmpeg product
VulnCheck Advisory: FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling third-party-advisory