OpenH264 is a free license codec library which supports H.264 encoding and decoding. A vulnerability in the decoding functions of OpenH264 codec library could allow a remote, unauthenticated attacker to trigger a heap overflow. This vulnerability is due to a race condition between a Sequence Parameter Set (SPS) memory allocation and a subsequent non Instantaneous Decoder Refresh (non-IDR) Network Abstraction Layer (NAL) unit memory usage. An attacker could exploit this vulnerability by crafting a malicious bitstream and tricking a victim user into processing an arbitrary video containing the malicious bistream. An exploit could allow the attacker to cause an unexpected crash in the victim's user decoding client and, possibly, perform arbitrary commands on the victim's host by abusing the heap overflow. This vulnerability affects OpenH264 2.5.0 and earlier releases. Both Scalable Video Coding (SVC) mode and Advanced Video Coding (AVC) mode are affected by this vulnerability. OpenH264 software releases 2.6.0 and later contained the fix for this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability. ### For more information If you have any questions or comments about this advisory: * [Open an issue in cisco/openh264](https://github.com/cisco/openh264/issues) * Email Cisco Open Source Security ([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT ([psirt@cisco.com](mailto:psirt@cisco.com)) ### Credits: * **Research:** Octavian Guzu and Andrew Calvano of Meta * **Fix ideation:** Philipp Hancke and Shyam Sadhwani of Meta * **Fix implementation:** Benzheng Zhang (@BenzhengZhang) * **Release engineering:** Benzheng Zhang (@BenzhengZhang)

The remote host is affected by the vulnerability described in GLSA-202507-06 (openh264: Heap Overflow)

    A vulnerability has been discovered in openh264. Please review the CVE identifiers referenced below for     details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 03ba1cdd-4faf-11f0-af06-00a098b42aeb advisory.

    Cisco reports:
    A vulnerability in the decoding functions             of OpenH264 codec library could allow a remote, unauthenticated             attacker to trigger a heap overflow.  This vulnerability is due to             a race condition between a Sequence Parameter Set (SPS) memory             allocation and a subsequent non Instantaneous Decoder Refresh             (non-IDR) Network Abstraction Layer (NAL) unit memory usage.  An             attacker could exploit this vulnerability by crafting a malicious             bitstream and tricking a victim user into processing an arbitrary             video containing the malicious bistream.  An exploit could allow             the attacker to cause an unexpected crash in the victim's user             decoding client and, possibly, perform arbitrary commands on the             victim's host by abusing the heap overflow.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenH264 is a free license codec library which supports H.264 encoding and decoding. A vulnerability in     the decoding functions of OpenH264 codec library could allow a remote, unauthenticated attacker to trigger     a heap overflow. This vulnerability is due to a race condition between a Sequence Parameter Set (SPS)     memory allocation and a subsequent non Instantaneous Decoder Refresh (non-IDR) Network Abstraction Layer     (NAL) unit memory usage. An attacker could exploit this vulnerability by crafting a malicious bitstream     and tricking a victim user into processing an arbitrary video containing the malicious bistream. An     exploit could allow the attacker to cause an unexpected crash in the victim's user decoding client and,     possibly, perform arbitrary commands on the victim's host by abusing the heap overflow. This vulnerability     affects OpenH264 2.5.0 and earlier releases. Both Scalable Video Coding (SVC) mode and Advanced Video     Coding (AVC) mode are affected by this vulnerability. OpenH264 software releases 2.6.0 and later contained     the fix for this vulnerability. Users are advised to upgrade. There are no known workarounds for this     vulnerability. ### For more information If you have any questions or comments about this advisory: * [Open     an issue in cisco/openh264](https://github.com/cisco/openh264/issues) * Email Cisco Open Source Security     ([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT     ([psirt@cisco.com](mailto:psirt@cisco.com)) ### Credits: * **Research:** Octavian Guzu and Andrew Calvano     of Meta * **Fix ideation:** Philipp Hancke and Shyam Sadhwani of Meta * **Fix implementation:** Benzheng     Zhang (@BenzhengZhang) * **Release engineering:** Benzheng Zhang (@BenzhengZhang) (CVE-2025-27091)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5870 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5870-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     February 26, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openh264     CVE ID         : CVE-2025-27091     Debian Bug     : 1098470

    A heap-based buffer overflow flaw in the decoding functions of openh264,     a codec library which supports H.264 encoding and decoding, may allow a     remote attacker to cause a denial of service or the execution of     arbitrary code if a specially crafted video is processed.

    For the stable distribution (bookworm), this problem has been fixed in     version 2.3.1+dfsg-3+deb12u1.

    We recommend that you upgrade your openh264 packages.

    For the detailed security status of openh264 please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/openh264

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241590	GLSA-202507-06 : openh264: Heap Overflow	Nessus	Gentoo Local Security Checks	high
240277	FreeBSD : cisco -- OpenH264 Decoding Functions Heap Overflow Vulnerability (03ba1cdd-4faf-11f0-af06-00a098b42aeb)	Nessus	FreeBSD Local Security Checks	high
231459	Linux Distros Unpatched Vulnerability : CVE-2025-27091	Nessus	Misc.	high
216859	Debian dsa-5870 : libopenh264-7 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2025-27091

high

Tenable Plugins

high

high

high

high