{"id":"CVE-2026-107696","title":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit","summary":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-835"],"vendor":"ffmpeg","product":"ffmpeg","affected":["ffmpeg <= 9.0.2"],"published":"2026-10-08","updated":"2026-10-14","sourceUpdated":"2026-10-14T23:54:22.317","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","label":"disclosure@vulncheck.com"},{"url":"https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","label":"disclosure@vulncheck.com"},{"url":"https://github.com/FFmpeg/FFmpeg","label":"disclosure@vulncheck.com"},{"url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-09T11:41:42.726482Z"},"epss":0.00359,"epssPercentile":0.29494,"ingestedAt":"2026-10-08T17:56:11.736Z","slug":"CVE-2026-107696","body":"## Overview\n\nFFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.\n\n## Affected\n\n- `ffmpeg <= 9.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":220525,"id":"CVE-2026-107696","ts":1792022626084,"field":"exploit_available","old":"false","new":"true"}]}