GHSA-5pmw-9j92-3c4c: OpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability

February 24, 2025

OpenH264 recently reported a heap overflow that was fixed in upstream 63db555 and integrated into our 0.6.6 release. For users relying on Cisco’s pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0.

In other words:

if you rely on our source feature only, >=0.6.6 should be safe,
if you rely on libloading, you must upgrade to 0.8.0 and use their latest DLL >=2.6.0.

Users handling untrusted video files should update immediately.

References

github.com/advisories/GHSA-5pmw-9j92-3c4c
github.com/cisco/openh264/pull/3818
github.com/ralfbiedert/openh264-rs
github.com/ralfbiedert/openh264-rs/commit/3a822fff0b4c9a984622ca2b179fe8898ac54b14
nvd.nist.gov/vuln/detail/CVE-2025-27091
rustsec.org/advisories/RUSTSEC-2025-0008.html

Code Behaviors & Features

Detect and mitigate GHSA-5pmw-9j92-3c4c with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →