GitStock

ralfbiedert/openh264-rs · Security

OpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability

GHSA ID
GHSA-5pmw-9j92-3c4c
Severity
high
Published
Updated
CVSS v4
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

OpenH264 recently reported a heap overflow that was fixed in upstream 63db555 and integrated into our 0.6.6 release. For users relying on Cisco's pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0.

In other words:

  • if you rely on our source feature only, >=0.6.6 should be safe,
  • if you rely on libloading, you must upgrade to 0.8.0 and use their latest DLL >=2.6.0.

Users handling untrusted video files should update immediately.

CWEs

  • CWE-122 · Heap-based Buffer Overflow
  • CWE-1395 · Dependency on Vulnerable Third-Party Component

References

Open GitHub