CVE-2025-52290: FFmpeg NULL Pointer Dereference DoS Vulnerability

CVE-2025-52290 Overview

CVE-2025-52290 is a NULL pointer dereference vulnerability in FFmpeg, the widely used open-source multimedia framework. The flaw resides in the avpriv_h264_has_num_reorder_frames function in FFmpeg build N-119856-gbe46370941. An attacker can trigger the condition by supplying a crafted media file for processing. Successful exploitation causes the FFmpeg process to crash, resulting in a Denial of Service (DoS). The weakness is tracked under [CWE-400] Uncontrolled Resource Consumption. No authentication or user interaction is required when FFmpeg automatically processes untrusted input, such as in media conversion pipelines or streaming services.

Critical Impact
Attackers can remotely crash FFmpeg-based services by submitting a crafted media file, disrupting media processing workflows and dependent applications.

Affected Products

FFmpeg version N-119856-gbe46370941
Applications and services that embed the affected FFmpeg build for media decoding
Media processing pipelines invoking avpriv_h264_has_num_reorder_frames

Discovery Timeline

2026-10-19 - CVE-2025-52290 published to the National Vulnerability Database (NVD)
2026-10-20 - Discussion posted to the Openwall OSS-Security list
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2025-52290

Vulnerability Analysis

FFmpeg's avpriv_h264_has_num_reorder_frames function is part of the H.264 video decoding path. The function inspects decoder state to determine how many reference frames must be buffered for correct output ordering. When processing a specially crafted media file, an internal pointer that the function relies on remains uninitialized or has been freed. Dereferencing that pointer causes an immediate segmentation fault in the hosting process. Because FFmpeg libraries (libavcodec, libavformat) are embedded in countless downstream applications, the crash propagates to any service that invokes the affected decoder path on attacker-controlled input.

Root Cause

The root cause is missing validation of a decoder context pointer prior to dereference inside avpriv_h264_has_num_reorder_frames. The crafted media file steers the H.264 parser into a state where the expected structure is never allocated. The function proceeds to access members of the NULL pointer, triggering a fatal fault. This maps to [CWE-400] because the condition is reachable through parser input that the application does not reject.

Attack Vector

Exploitation is network-reachable and requires no privileges or user interaction. An attacker uploads or streams a crafted H.264-containing media file to any endpoint that routes input through the vulnerable FFmpeg build. Common attack surfaces include video transcoding services, thumbnailers, media CDNs, upload portals, and chat platforms that preview attachments. Each submission crashes the worker handling the file, and repeated submissions sustain the Denial of Service.

No verified public proof-of-concept code is available at the time of publication. The vulnerability manifests during H.264 reorder-frame handling. See the Openwall OSS-Security discussion and the FFmpeg project site for technical context.

Detection Methods for CVE-2025-52290

Indicators of Compromise

Repeated FFmpeg or libavcodec process crashes with segmentation fault signatures referencing avpriv_h264_has_num_reorder_frames
Core dumps generated by media worker processes shortly after accepting untrusted input
Spikes in failed transcoding jobs or 5xx responses from media processing APIs
Unusual H.264 media files received from untrusted sources with malformed sequence parameter sets

Detection Strategies

Monitor process exit codes and crash telemetry for FFmpeg workers and parent services
Enable application logs that capture decoder errors and correlate with inbound file hashes
Deploy fuzzing or sandboxed pre-validation of H.264 inputs before passing to production decoders
Alert on recurring crashes tied to the same uploader, source IP, or tenant

Monitoring Recommendations

Track FFmpeg library versions deployed across hosts, containers, and third-party dependencies
Instrument media pipelines with structured error reporting that surfaces decoder stack traces
Review web application firewall (WAF) and gateway logs for repeated media uploads producing processing errors

How to Mitigate CVE-2025-52290

Immediate Actions Required

Inventory all systems using FFmpeg build N-119856-gbe46370941 or derived binaries
Restrict acceptance of untrusted media files until a patched FFmpeg build is deployed
Run FFmpeg workers under process supervisors that auto-restart on crash to limit availability impact
Isolate media decoding in sandboxed containers with resource limits to contain crashes

Patch Information

No vendor patch URL is listed in the NVD advisory at publication. Monitor the FFmpeg project website and the Openwall OSS-Security discussion for an updated build that adds pointer validation inside avpriv_h264_has_num_reorder_frames. Rebuild downstream applications against the fixed FFmpeg release once available.

Workarounds

Pre-validate media files with a hardened parser before invoking FFmpeg
Disable the H.264 decoder path in environments that do not require it
Rate-limit and authenticate media upload endpoints to reduce exposure to anonymous crafted input
Run decoders in short-lived, memory-limited sandboxes so a crash does not degrade shared infrastructure

bash

# Example: run ffmpeg in an isolated, resource-limited sandbox
systemd-run --scope \
  --property=MemoryMax=512M \
  --property=CPUQuota=50% \
  --property=PrivateNetwork=yes \
  ffmpeg -i /input/untrusted.mp4 -f null -