Heap Overflow Vulnerability in OpenH264 Codec Library
Summary
DEBIAN-CVE-2025-27091: OpenH264 is a free license codec library which supports H.264 encoding and decoding. Affects openh264 versions < 2.3.1+dfsg-3+deb12u1. Fixed in 2.3.1+dfsg-3+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenH264 is a free license codec library developed by Cisco that supports H.264 encoding and decoding. It is widely used in various applications for video processing due to its efficiency and performance. However, a critical vulnerability has been identified in the decoding functions of this library, which could potentially expose users to significant security risks.
Vulnerability Detail
The vulnerability arises from a race condition between a Sequence Parameter Set (SPS) memory allocation and subsequent non-Instantaneous Decoder Refresh (non-IDR) Network Abstraction Layer (NAL) unit memory usage. This flaw allows a remote, unauthenticated attacker to craft a malicious bitstream that, when processed by a victim's user decoding client, could trigger a heap overflow. The consequences of this vulnerability include unexpected crashes and the potential for attackers to execute arbitrary commands on the victim's host system.
How To Fix
Minimum fixed version
2.3.1+dfsg-3+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openh264Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to upgrade to the patched version of OpenH264.
Conclusion
The identified heap overflow vulnerability in the OpenH264 codec library poses significant risks to users. Immediate action is required to upgrade to the patched version to mitigate these risks. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for openh264 →
FAQ
OpenH264 is a codec library that enables encoding and decoding of H.264 video streams, widely used in video applications.
The vulnerability allows attackers to exploit a heap overflow, potentially leading to crashes or unauthorized command execution on affected systems.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without needing access to the code. Visit Vulert Scanner to check your application.
Yes, upgrading to OpenH264 version 2.6.0 or later will resolve the vulnerability.
Unfortunately, there are no workarounds available. It is highly recommended to upgrade to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for openh264.
