CVE-2025-52290: Null Pointer Dereference
A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to cause FFmpeg to process a crafted media file. The CVSS vector indicates exploitation does not require authentication or user interaction.
What is the likely impact of successful exploitation?
Successful exploitation can cause a denial of service through a NULL pointer dereference in avpriv_h264_has_num_reorder_frames. The provided CVSS metrics indicate availability impact, with no stated confidentiality or integrity impact.
How can I determine whether an environment is affected?
Check whether the FFmpeg build in use is version N-119856-gbe46370941. Systems that process untrusted media files are the relevant exposure scenario described by the vulnerability data.