FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers… (CVE-2026-107675)

The vulnerability in FFmpeg up to version 9.0.2 involves missing host key verification in the libssh-based SFTP protocol handler. This security gap enables attackers positioned on the network to impersonate legitimate SFTP servers by exploiting man-in-the-middle, DNS spoofing, or ARP spoofing techniques. As a result, attackers can capture sensitive credentials embedded in SFTP URLs, deliver maliciously forged media files, or intercept data being uploaded via SFTP.

Successful exploitation allows attackers to capture passwords used in SFTP URLs, impersonate SFTP servers to serve forged media content, and intercept uploaded output data. This compromises confidentiality and integrity of data transmitted over SFTP using FFmpeg's libssh handler.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using FFmpeg's libssh-based SFTP handler over untrusted networks or employ network-level protections to prevent man-in-the-middle and spoofing attacks.