FFmpeg EUVD-2025-211132

Exploitation requires the target to decode an attacker-supplied crafted media file through the H.264 code path that reaches avpriv_h264_has_num_reorder_frames in the vulnerable FFmpeg build (N-119856-gbe46370941); the crash occurs during parsing/decoding of that file. The practical limiting factor is delivery and auto-processing: the condition is fully met for services that automatically ingest and decode uploaded or fetched media (upload portals, transcoding/streaming backends, thumbnailers), where it is effectively remote and unauthenticated; it is materially limited for endpoints where a user must manually open the file, which adds a user-interaction requirement the CVSS vector (UI:N) does not reflect. No special configuration flag is named in the description beyond use of the affected H.264 decoding functionality.

This is a memory-safety Denial-of-Service bug (NULL pointer dereference) in FFmpeg's H.264 handling, not a code-execution flaw - confidentiality and integrity impact are explicitly None (C:N/I:N) and only availability is affected (A:H). The CVSS 3.1 base score of 7.5 is driven entirely by the network, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N), which rates it HIGH, but the real-world risk signals are considerably softer: CISA SSVC lists Exploitation as 'none' (no observed or public exploitation), Technical Impact as 'partial' (a crash, not full compromise), and while Automatable is 'yes', the outcome is still only a DoS. There is no CISA KEV listing and no public exploit identified in the provided data, so this is best characterized as a high-CVSS-but-moderate-real-risk issue - a reliability/availability concern rather than an urgent breach vector. Note a tension between the metadata and the description: CVSS marks AV:N, but exploitation requires the target to actually process a crafted media file, so the 'network' vector only holds for deployments where FFmpeg automatically ingests attacker-supplied media (e.g. upload/transcoding pipelines); for a desktop user who must manually open a file, real-world access is closer to local/UI-dependent - verify against the specific deployment. Also note the CWE is labeled CWE-400 (Uncontrolled Resource Consumption) whereas the description states a NULL pointer dereference (typically CWE-476); treat the mechanism as a crash-on-parse, not resource exhaustion.

An attacker crafts a malformed media file that triggers the NULL pointer dereference in avpriv_h264_has_num_reorder_frames and delivers it to a service or application that automatically decodes it with the vulnerable FFmpeg build (e.g. a media upload/transcoding backend). When FFmpeg parses the file it dereferences a NULL pointer and crashes, denying service; repeated submissions sustain the outage. No public exploit was identified at time of analysis, and the low attack complexity means a reliable crash file is straightforward to produce once the defect is understood.