CVE-2025-52290

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in FFmpeg Leads to DoS

Publication date: 2026-10-19

Last updated on: 2026-10-28

Assigner: MITRE

Description

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-28

Generated

2026-11-09

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-08

NVD

CVE-2025-52290

EUVD

EUVD-2025-211132

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of FFmpeg. It allows attackers to cause a Denial of Service by processing a specially crafted media file.

Detection Guidance

Detecting this NULL pointer dereference vulnerability in FFmpeg requires analyzing media files for crashes or errors when processed by vulnerable versions. Use FFmpeg commands like 'ffmpeg -i input.mp4 -f null -' to test files. Monitor for segmentation faults or 'Segmentation fault (core dumped)' messages. Check FFmpeg version with 'ffmpeg -version' and compare against patched releases.

Impact Analysis

The vulnerability can cause a Denial of Service, meaning an attacker could crash the application or system processing the malicious media file, leading to service disruption.

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via a NULL pointer dereference, which may lead to system crashes or instability when processing media files. While it does not directly expose data, prolonged DoS conditions could impact availability of systems handling sensitive data, potentially affecting compliance with availability requirements in GDPR or HIPAA.

Mitigation Strategies

Update FFmpeg to the latest stable version to address the NULL pointer dereference issue in avpriv_h264_has_num_reorder_frames.

Hi! I’m here to help you understand CVE-2025-52290. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...