FFmpeg EUVD-2026-95126

Exploitation requires that a target application or user invoke FFmpeg on an attacker-controlled RTSP input (an rtsp:// URL or stream) whose malicious server returns an RTSP 3xx redirect with a Location header pointing to an internal host/port under another scheme; the vulnerable ff_rtsp_connect() in libavformat/rtsp.c then follows it without validating the Location, defeating the -protocol_whitelist control. Limiting factors: passive user interaction is required (UI:P) - the attacker cannot act without a victim processing the malicious source - and only FFmpeg builds before 7.1.4 or in the 8.0.x line before 8.0.2 are affected; no authentication is needed (PR:N). Impact is constrained to probing/reaching internal services, not arbitrary read or code execution.

This is a medium-severity SSRF (CVSS 4.0 base 5.3) whose signals consistently point to a limited, opportunistic rather than high-priority threat. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N shows network reach with low attack complexity and no privileges, but exploitation hinges on passive user interaction (UI:P): a victim application or user must be induced to process an attacker-controlled RTSP source. Impact is deliberately capped at low confidentiality and low integrity with no availability effect and no subsequent-system (scope) impact, consistent with an internal-service-probing primitive rather than code execution or data theft. EPSS is not provided in the input, so exploitation probability cannot be quantified; the CVE is NOT on CISA KEV and no public exploit code is referenced, so under an SSVC-style read exploitation status is 'none', the flaw is only partially automatable (it requires luring a target into parsing a malicious RTSP URL), and technical impact is partial. Net: a real but modest issue - patch in normal cycles, prioritize where FFmpeg ingests untrusted RTSP/remote URLs. No signals conflict; the main data gap is the absent EPSS score and the absence of any POC reference, which keeps confidence about real-world exploitation low.

An application or service that invokes FFmpeg on user-supplied media URLs (for example a transcoding pipeline, thumbnail generator, or upload-by-URL feature) is pointed at an attacker-controlled rtsp:// endpoint. The malicious RTSP server responds with a 3xx redirect whose Location targets an internal host and port under a different scheme, and FFmpeg follows it without validating the URL - bypassing -protocol_whitelist - letting the attacker probe otherwise unreachable internal network services. No public exploit code is referenced in the available data, and UI:P means a victim must first be induced to process the malicious source.