Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 16.8%
CVSS Severity
CVSS v3 Score 5.4
Products affected by CVE-2026-107698
  • Ffmpeg » Ffmpeg » Version: 2.8.21
    cpe:2.3:a:ffmpeg:ffmpeg:2.8.21
  • Ffmpeg » Ffmpeg » Version: 2.8.22
    cpe:2.3:a:ffmpeg:ffmpeg:2.8.22
  • Ffmpeg » Ffmpeg » Version: 3.2.19
    cpe:2.3:a:ffmpeg:ffmpeg:3.2.19
  • Ffmpeg » Ffmpeg » Version: 4.3
    cpe:2.3:a:ffmpeg:ffmpeg:4.3
  • Ffmpeg » Ffmpeg » Version: 4.4
    cpe:2.3:a:ffmpeg:ffmpeg:4.4
  • Ffmpeg » Ffmpeg » Version: 4.4.7
    cpe:2.3:a:ffmpeg:ffmpeg:4.4.7
  • Ffmpeg » Ffmpeg » Version: 4.4.8
    cpe:2.3:a:ffmpeg:ffmpeg:4.4.8
  • Ffmpeg » Ffmpeg » Version: 5.1
    cpe:2.3:a:ffmpeg:ffmpeg:5.1
  • Ffmpeg » Ffmpeg » Version: 6.1
    cpe:2.3:a:ffmpeg:ffmpeg:6.1
  • Ffmpeg » Ffmpeg » Version: 8.0
    cpe:2.3:a:ffmpeg:ffmpeg:8.0
  • Ffmpeg » Ffmpeg » Version: 8.0.1
    cpe:2.3:a:ffmpeg:ffmpeg:8.0.1


Products
Pricing
Contact Us

Shodan ® - All rights reserved