GitHub Advisoryadvisory · crates.io

GHSA-5pmw-9j92-3c4c OpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability

HIGH Published 2025-02-24 Modified 2025-02-24 Official page ↗
Ecosystem
crates.io
Packages
openh264-sys2
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-122, CWE-1395
Reviewed
2025-02-24

Affected packages

• crates.io openh264-sys2: < 0.8.0 → fixed in 0.8.0

Description

OpenH264 recently reported a heap overflow that was fixed in upstream 63db555 and integrated into our 0.6.6 release. For users relying on Cisco's pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0. In other words: • if you rely on our `source` feature only, >=0.6.6 should be safe, • if you rely on `libloading`, you must upgrade to 0.8.0 _and_ use their latest DLL >=2.6.0. Users handling untrusted video files should update immediately.

Related

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References