Denial of Service Vulnerability in FFmpeg: CVE-2025-52290
Summary
DEBIAN-CVE-2025-52290: A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file. Affects ffmpeg versions 7:5.1.3-1 – 7:9.0.2-4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source software suite for handling multimedia data. It provides tools for video and audio processing, including conversion, streaming, and playback. FFmpeg is known for its extensive format support and powerful capabilities, making it a popular choice among developers and media professionals. However, like any software, it is not immune to vulnerabilities. The vulnerability identified as CVE-2025-52290 affects FFmpeg versions prior to a patch, allowing attackers to exploit a NULL pointer dereference, leading to potential Denial of Service (DoS) attacks when processing specially crafted media files.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function within FFmpeg. This flaw can be exploited by attackers who craft malicious media files that, when processed by the affected FFmpeg versions, can cause the application to crash or become unresponsive. The implications of this vulnerability are significant, as it can disrupt services relying on FFmpeg for media processing, leading to service outages and degraded user experience.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or unknown media files until the package is updated. Additionally, implementing strict input validation and sanitization can help mitigate the risk of exploitation.
Conclusion
CVE-2025-52290 represents a significant vulnerability in FFmpeg that can lead to Denial of Service attacks. Users are strongly encouraged to update their FFmpeg installations to the latest version to protect against potential exploits. Additionally, employing best practices for media file handling can further enhance security.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2025-52290 is a vulnerability in FFmpeg that allows for a Denial of Service (DoS) attack due to a NULL pointer dereference.
All versions of FFmpeg prior to the patch addressing CVE-2025-52290 are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to application crashes or unresponsiveness, resulting in service disruptions and a poor user experience.
Yes, a patch has been released for FFmpeg. Users are advised to update to the latest version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
