FFmpeg NULL dereference crash via crafted media (CVE-2025-52290)
Development snapshot N-119856-gbe46370941 is affected; CISA-ADP scores remote unauthenticated denial of service at CVSS 7.5.
46
CVE-2025-52290
NULL pointer dereference DoS in FFmpeg H.264 handling
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A NULL pointer dereference in FFmpeg’s avpriv_h264_has_num_reorder_frames function can crash the process when it handles a crafted media file, causing a denial of service. The issue is reachable over the network without authentication or user interaction. It is reported in FFmpeg version N-119856-gbe46370941. No other products or builds are listed.
What to do: Apply FFmpeg’s update for CVE-2025-52290. No fixed version is stated.
| Product | Affected |
|---|---|
| FFmpeg | N-119856-gbe46370941 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.
- Weakness
- CWE-400
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H