OpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
OpenH264 recently reported a [heap overflow](https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x) that was fixed in upstream [63db555](https://github.com/cisco/openh264/commit/63db555e30986e3a5f07871368dc90ae78c27449) and [integrated into](https://github.com/ralfbiedert/openh264-rs/commit/3a822fff0b4c9a984622ca2b179fe8898ac54b14) our 0.6.6 release. For users relying on Cisco's pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0. In other words: - if you rely on our `source` feature only, >=0.6.6 should be safe, - if you rely on `libloading`, you must upgrade to 0.8.0 _and_ use their latest DLL >=2.6.0. Users handling untrusted video files should update immediately.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | openh264-sys2 (crates.io) | before 0.8.0 | 0.8.0 | Patch available | GHSA-5pmw-9j92-3c4c |
- openh264-sys2 (crates.io) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-5pmw-9j92-3c4c
Remediation
- Fix · GHSA-5pmw-9j92-3c4c openh264-sys2 (crates.io) Fixed in 0.8.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-5pmw-9j92-3c4c
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences