5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-25473

CVE-2025-25473: FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via...

FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-25473

CVE-2025-25473:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is described as a NULL pointer dereference in libavformat/mov.c. The provided patch from the commit c08d300481b8ebb846cd43a473988fdbc6793d1b is in libavformat/avformat.c, specifically in the avformat_free_context function. The patch adds a line, avpriv_packet_list_free(&si->packet_buffer);, to this function. This addition implies that before the patch, avformat_free_context was not freeing si->packet_buffer. This failure to free the buffer could lead to a memory leak or, more critically for a NULL pointer dereference, could leave a stale pointer or an inconsistent state for this buffer. If code within libavformat/mov.c (as stated in the vulnerability description) subsequently attempted to access or use this packet_buffer (or pointers derived from it) after avformat_free_context had been called (particularly in an error or cleanup scenario where resources might be partially released), it could encounter a NULL or invalid pointer, leading to the dereference. Therefore, avformat_free_context (in its unpatched state) is identified as a function contributing to the vulnerability by failing to perform necessary cleanup, which then manifests as a crash in libavformat/mov.c. The confidence is 'medium' because while avformat_free_context is clearly involved in creating the vulnerable state by its omission, the actual dereferencing function within libavformat/mov.c is not explicitly shown or modified in the provided patch details for avformat.c.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.