{"id":"CVE-2025-52290","kind":"vulnerability","aliases":["CVE-2025-52290"],"related":[],"title":"FFmpeg: crafted media file crashes decoder via H.264 null pointer","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.","summary":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of FFmpeg N-119856 lets a crafted media file crash the process. An attacker gets a denial of service, not code execution, according to the source description.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"N-119856-gbe46370941 (full range unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","ffmpeg","libavcodec","media-processing","package","self-hosted"],"not_affected_if":["no-h264-decoding","no-untrusted-media"],"how_to_check":"- Run `ffmpeg -version`; a git build at or near N-119856-gbe46370941 is the tested one. Distro/release builds are not stated as affected or unaffected.\n- Reproduce on a test box only: `ffmpeg -i 1_poc.mp4 -f null -` with the public sample; a crash (SEGV in avpriv_h264_has_num_reorder_frames) means exposed.\n- Check whether any upload, transcoding or thumbnail pipeline runs ffmpeg/libavformat on untrusted files.","fix":"unknown: no fixing commit or release identified as of 2026-10-25. Until then, do not feed untrusted media to FFmpeg without sandboxing (separate process, resource limits, auto-restart); re-check ffmpeg.org / git master for a fix to h264dec.c / libavformat/demux.c.","status":"open","published_at":"2026-10-19T18:16:58+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:22:56+00:00","updated_at":"2026-10-25T03:40:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:22:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted media file crashes decoder via H.264 null pointer","impact":"low","summary":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of FFmpeg N-119856 lets a crafted media file crash the process. An attacker gets a denial of service, not code execution, according to the source description.","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Decoding process crashes, causing denial of service for the service","analyst_note":"Find the upstream fix commit or patched FFmpeg version and the affected version range in the NVD entry or FFmpeg trac.","how_to_check":"- Run `ffmpeg -version` and see whether the build is the N-119856-gbe46370941 snapshot or an older git build.\n- Check whether the application decodes untrusted H.264 media with the affected FFmpeg libraries (libavcodec).","needs_analyst":true,"not_affected_if":["no-untrusted-media"],"who_is_affected":"Services that decode H.264 media from untrusted sources with an affected FFmpeg build, such as upload processing, transcoding or thumbnailing pipelines. Teams using released FFmpeg packages from their distribution or a pinned newer build, and systems that never parse user-supplied video, are less likely to be exposed. The sources do not name a fixed version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":3313,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the upstream fix commit or patched FFmpeg version and the affected version range in the NVD entry or FFmpeg trac.","search":"'-119856':47B,88C '-2025':12A,15A '-52290':13A,16A 'accord':66B 'allow':90C 'attack':57B,91C 'avpriv':37B,77C 'caus':93C 'code':64B 'craft':2A,50B,102C 'crash':5A,53B 'cve':11A,14A 'decod':6A 'denial':19B,60B,95C 'denial-of-servic':18B 'derefer':34B,74C 'descript':70B 'dos':98C 'execut':65B 'ffmpeg':1A,17A,22B,45B,85C 'file':4A,52B,104C 'frame':42B,82C 'function':43B,83C 'gbe46370941':89C 'get':58B 'h.264':8A 'h264':38B,78C 'host':30B 'let':48B 'libavcodec':23B 'media':3A,25B,51B,103C 'media-process':24B 'n':46B,87C 'null':9A,32B,72C 'num':40B,80C 'packag':27B 'pointer':10A,33B,73C 'process':26B,55B,100C 'reorder':41B,81C 'self':29B 'self-host':28B 'servic':21B,62B,97C 'sourc':69B 'version':86C 'via':7A,99C","nicknames":[],"mitigations":[],"who_affected":"Services that run FFmpeg (libavformat/libavcodec) on untrusted media, such as upload processing, transcoding or thumbnailing pipelines, can be crashed by one crafted file (MPEG-TS input with mismatched codec context). Impact is denial of service only; no code execution shown. Teams that only process their own trusted media can skip it. The full affected range is not established.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2025-52290","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","severity":null,"published_at":"2026-10-19T18:16:58+00:00","modified_at":"2026-10-20T19:17:10+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-52290:766","url":null,"severity":null,"published_at":"2026-10-25T03:40:17+00:00","modified_at":"2026-10-25T03:40:17+00:00","first_seen_at":"2026-10-25T03:40:17+00:00","fetched_at":"2026-10-25T03:40:17+00:00","note":"Read reporter's oss-security disclosure: only tested rev N-119856-gbe46370941 (commit be46370941405fb04402d96373a53e2a1846f3ac); no fix commit or fixed release exists in disclosure; range not established; FFmpeg maintainers suggested independent publication. Public PoC sample (1_poc.mp4), no exploitation reported. Nothing verified: no FFmpeg primary advisory/trac found."}],"documents":[{"id":3273,"url":"https://www.openwall.com/lists/oss-security/2026/10/20/6","title":"oss-security: CVE-2025-52290 FFmpeg NULL deref (reporter disclosure)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3274,"url":"https://github.com/sigdevel/pocs/blob/main/res/FFmpeg/ffmpeg/1/1_poc.mp4","title":"1_poc.mp4 PoC sample","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3276,"url":"https://access.redhat.com/security/cve/cve-2025-52290","title":"Red Hat: CVE-2025-52290","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}