Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

FFmpeg NULL dereference crash via crafted media (CVE-2025-52290)

Original title: CVE-2025-52290: FFmpeg NULL pointer dereference in avpriv_h264_has_num_reorder_frames

oss-security ()1 · 1 read
Read at seclists.org
AI summary · x-ai/grok-4.7Summaries by Vani AI

Development snapshot N-119856-gbe46370941 is affected; CISA-ADP scores remote unauthenticated denial of service at CVSS 7.5.

Alexander A. Shvedov reported CVE-2025-52290, a NULL pointer dereference in FFmpeg's avpriv_h264_has_num_reorder_frames. Processing a crafted media file can crash FFmpeg. The affected build is N-119856-gbe46370941, commit be46370941405fb04402d96373a53e2a1846f3ac, covering ffmpeg, libavcodec and libavformat. CISA-ADP rates it CVSS 3.1 7.5 High, with availability impact only. The snippet does not name a fix.

Unconfirmed: The truncated post does not say whether a fix exists or whether attacks are known.

Key facts
  • The reporter classifies the bug as CWE-476.
  • The score requires no privileges and no user interaction.
  • Confidentiality and integrity impacts are none.
  • No fixed release is stated in the snippet.
Security assessment · AI, from the article

Impact: Remote crash and denial of service

ProductAffected
FFmpegN-119856-gbe46370941 (commit be46370941405fb04402d96373a53e2a1846f3ac)
Analyze CVE-2025-52290 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-52290
Tags
ffmpeglibavcodecnull-dereferencedenial-of-servicemedia
Vendors
FFmpeg
Products
libavcodeclibavformat

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-52290
NULL pointer dereference DoS in FFmpeg H.264 handling
7.5—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha1be46370941405fb04402d96373a53e2a1846f3acvcodec / libavformat) Affected: N-119856-gbe46370941 Commit be46370941405fb04402d96373a53e2a1846f3ac CVE: CVE-2025-52290 CWE: CWE-476 (NULL Pointer Dereference;

From the original article

Posted by Alexander A. Shvedov on Oct 20 Product: FFmpeg (ffmpeg / libavcodec / libavformat) Affected: N-119856-gbe46370941 Commit be46370941405fb04402d96373a53e2a1846f3ac CVE: CVE-2025-52290 CWE: CWE-476 (NULL Pointer Dereference; reporter classification) CVSS 3. 1: 7.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.