FFmpeg versions before 7.1.4 and 8.0.x before 8.0.2 have a server-side request forgery flaw in the rtsp.c connection routine that follows RTSP 3xx redirects without validating the Location URL. The vulnerability allows an attacker who controls an RTSP server to redirect FFmpeg to any host or port, including internal network services, bypassing the protocol whitelist filter. This can result in the FFmpeg process probing or probing in ways that expose information about internal hosts, potentially facilitating further attacks or reconnaissance.

The flaw affects all FFmpeg binaries relying on the libavformat/rtsp.c routine, specifically releases before 7.1.4 and releases of the 8.0 series before 8.0.2. Systems running those exact releases are vulnerable; upgrading to FFmpeg 7.1.4 or later, or 8.0.2 or later, removes the issue.

The CVSS score of 5.3 classifies the vulnerability as moderate. No EPSS value is provided, and the security advisory is not listed in the CISA KEV catalog. The attack vector is remote; an attacker must control an RTSP server and initiate a connection from the vulnerable FFmpeg instance. If achieved, the attacker can redirect the client to arbitrary destinations, allowing internal network enumeration and potentially exposing sensitive services.