CVE-2025-52290 in FFmpeg
Summary
by MITRE • 10/19/2026
A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in FFmpeg, specifically within the avpriv_h264_has_num_reorder_frames function as part of commit N-119856-gbe46370941, represents a critical memory safety issue classified under CWE-476: NULL Pointer Dereference. This flaw occurs when the software attempts to access a memory location that has not been allocated or initialized properly, resulting in an invalid reference. In the context of FFmpeg, which is widely used for processing video and audio streams, such errors can be triggered by parsing malformed or specially crafted media files designed to exploit this specific code path. The function is responsible for determining whether there are reorder frames present in H264 encoded data, a common step during decoding processes where the decoder must understand frame ordering to reconstruct images correctly.
When an attacker provides a maliciously constructed input file that causes internal pointers within the avpriv_h264_has_num_reorder_frames function to remain null or uninitialized, the application attempts to dereference these invalid addresses. This action violates standard memory management protocols and leads directly to a segmentation fault or similar critical error in most operating environments. The immediate operational impact is a Denial of Service (DoS), where the FFmpeg process crashes abruptly upon encountering the crafted file. For applications relying on FFmpeg as a library, such as video players, streaming servers, or content processing pipelines, this crash can disrupt service availability, cause data loss if unsaved work is involved, and potentially destabilize the host system depending on how the error is handled by the surrounding application logic.
From an offensive security perspective, while primarily categorized as a DoS vector in its current description, NULL pointer dereferences can sometimes be leveraged for more severe outcomes such as arbitrary code execution if specific memory layout conditions are met and additional exploitation techniques like heap spraying or return-oriented programming are applied. However, the primary risk here remains service disruption. This vulnerability aligns with ATT&CK technique T1499: Endpoint Denial of Service, where adversaries aim to degrade or destroy the availability of a target system by exhausting resources or causing crashes through malformed inputs. It also relates to CWE-20: Improper Input Validation, as the root cause often stems from insufficient checks on input data before it is processed by critical decoding functions.
Mitigation strategies for this vulnerability involve both immediate patching and long-term defensive coding practices. The most effective remediation is to update FFmpeg to a version that includes the fix for commit N-119856-gbe46370941, ensuring that null checks are properly implemented within the avpriv_h264_has_num_reorder_frames function before any pointer dereference occurs. Developers should enforce strict input validation at all entry points of media processing pipelines to reject malformed files early in the process. Additionally, employing fuzzing techniques during development can help identify similar edge cases where pointers might not be initialized correctly under unusual or adversarial conditions. Security teams monitoring for this vulnerability should look for crashes associated with H264 decoding and ensure that their FFmpeg dependencies are kept up-to-date to prevent exploitation of known memory safety flaws.