CVE-2025-52290: Null Pointer Dereference

Published Oct 19, 2026

Updated

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.

Affected Software

1 affected component

FFmpeg FFmpeg=N-119856-gbe46370941

Event History

Oct 19, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause FFmpeg to process a crafted media file. The CVSS vector indicates exploitation does not require authentication or user interaction.

What is the likely impact of successful exploitation?

Successful exploitation can cause a denial of service through a NULL pointer dereference in avpriv_h264_has_num_reorder_frames. The provided CVSS metrics indicate availability impact, with no stated confidentiality or integrity impact.

How can I determine whether an environment is affected?

Check whether the FFmpeg build in use is version N-119856-gbe46370941. Systems that process untrusted media files are the relevant exposure scenario described by the vulnerability data.

CVE-2025-52290: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

How can I determine whether an environment is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

How can I determine whether an environment is affected?