CVE-2025-52290

7.5High

Published 19 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400

Impact

Remote attackers can crash services processing media files, causing a denial of service. They only need to supply a crafted media file without needing prior authentication.

Root cause

A NULL pointer dereference occurs inside the avpriv_h264_has_num_reorder_frames function when parsing crafted H.264 video data.

Affected systems

FFmpeg version N-119856-gbe46370941; other versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade to a git commit or FFmpeg release past N-119856-gbe46370941 once available. As an interim workaround, avoid ingesting untrusted H.264 streams or isolate media parsing in sandboxed, auto-restarting worker processes.

shell

$ ffmpeg -version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.

References

Source: nvd.nist.gov/vuln/detail/CVE-2025-52290