CVE-2025-25471: FFmpeg NULL Pointer Dereference Vulnerability

CVE-2025-25471 Overview

CVE-2025-25471 is a NULL pointer dereference vulnerability in FFmpeg, an open-source multimedia framework widely used for processing audio and video files. The flaw resides in the libavformat/mov.c component, which handles parsing of MOV, MP4, and related container formats. Affected builds are FFmpeg git master versions before commit fd1772b7475d0d5673a5dd314ee78443d0be4cf1. Successful exploitation allows an attacker to trigger a process crash, resulting in denial of service against applications that use FFmpeg for media parsing. The vulnerability is tracked under CWE-476.

Critical Impact
Attackers on an adjacent network can supply a crafted media file that dereferences a NULL pointer in libavformat/mov.c, crashing the FFmpeg process and impacting integrity of media processing pipelines.

Affected Products

FFmpeg git master prior to commit fd1772b7475d0d5673a5dd314ee78443d0be4cf1
Applications embedding vulnerable libavformat builds for MOV/MP4 parsing
Downstream projects tracking FFmpeg master before the fix

Discovery Timeline

2025-02-18 - CVE-2025-25471 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25471

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] within libavformat/mov.c, the demuxer responsible for parsing QuickTime/MP4 container atoms. When FFmpeg processes a malformed MOV input, code paths in the demuxer fail to validate that an internal pointer, such as a stream context or atom structure reference, was successfully allocated or populated before use. Dereferencing that NULL pointer triggers a segmentation fault. The result is an abnormal termination of the FFmpeg process, which affects any application, service, or pipeline that consumes untrusted media through the vulnerable code path. The upstream fix landed in commit fd1772b7475d0d5673a5dd314ee78443d0be4cf1, tracked publicly in FFmpeg Ticket #11417.

Root Cause

The root cause is missing validation of a pointer returned or referenced during MOV atom parsing in libavformat/mov.c. The demuxer assumes an object is present and dereferences its fields directly. When crafted input causes that allocation or lookup to return NULL, the process crashes rather than failing gracefully with an error.

Attack Vector

The attack vector is adjacent network. An attacker delivers a crafted MOV or MP4 file to a service that invokes FFmpeg on the input, for example, a media transcoding backend, streaming ingest node, or thumbnailer. No authentication or user interaction is required. Impact is limited to integrity of the affected processing, with no confidentiality or availability rating in the CVSS vector, though process termination is the practical outcome.

No verified public proof-of-concept code is available. Refer to the upstream FFmpeg Commit Record for the exact code paths corrected by the patch.

Detection Methods for CVE-2025-25471

Indicators of Compromise

Unexpected FFmpeg process crashes or SIGSEGV signals recorded in system logs when parsing MOV or MP4 inputs
Core dump artifacts referencing symbols within libavformat/mov.c
Repeated failed media transcoding jobs tied to specific untrusted input files

Detection Strategies

Inventory FFmpeg builds across servers and containers, flagging any git master build prior to commit fd1772b7475d0d5673a5dd314ee78443d0be4cf1
Monitor application logs from media processing services for abnormal exit codes correlated with MOV/MP4 uploads
Enable crash reporting on transcoding hosts to capture stack traces implicating the MOV demuxer

Monitoring Recommendations

Alert on repeated FFmpeg segmentation faults within short time windows on the same host
Track the ingress of MOV/MP4 uploads from adjacent network sources and correlate with worker process restarts
Log and retain the file hashes of media inputs that trigger demuxer failures for later analysis

How to Mitigate CVE-2025-25471

Immediate Actions Required

Update FFmpeg builds to a revision that includes commit fd1772b7475d0d5673a5dd314ee78443d0be4cf1 or later
Rebuild and redeploy any containers, packages, or applications statically linking libavformat
Restrict acceptance of MOV and MP4 files from untrusted or adjacent network sources until patched

Patch Information

The upstream fix is available in the FFmpeg repository as commit fd1772b7475d0d5673a5dd314ee78443d0be4cf1. Distributions and downstream projects tracking FFmpeg git master should pull the corrected revision. Details are documented in the FFmpeg Commit Record and FFmpeg Ticket #11417.

Workarounds

Run FFmpeg in a sandboxed or isolated worker process so a crash does not affect the host or other jobs
Validate and reject malformed MOV/MP4 atoms at an upstream proxy before invoking FFmpeg
Implement automatic restart and rate-limit logic on transcoding workers to contain repeated denial-of-service attempts

bash

# Verify installed FFmpeg build includes the fix
ffmpeg -version
git -C /path/to/ffmpeg log --oneline | grep fd1772b7475d0d5673a5dd314ee78443d0be4cf1