CVE-2025-27091
Published: 20 February 2025
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2025-27091 is a heap overflow vulnerability in the decoding functions of the OpenH264 codec library, which supports H.264 encoding and decoding under a free license. The issue stems from a race condition between Sequence Parameter Set (SPS) memory allocation and subsequent non-Instantaneous Decoder Refresh (non-IDR) Network Abstraction Layer (NAL) unit memory usage. It affects OpenH264 versions 2.5.0 and earlier, impacting both Scalable Video Coding (SVC) mode and Advanced Video Coding (AVC) mode.
A remote, unauthenticated attacker can exploit this vulnerability by crafting a malicious bitstream and tricking a victim into processing an arbitrary video containing it. Successful exploitation may cause an unexpected crash in the victim's decoding client and, by abusing the heap overflow, potentially enable arbitrary command execution on the victim's host. The CVSS v3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with associated CWEs-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write).
Advisories recommend upgrading to OpenH264 releases 2.6.0 or later, which contain the fix. There are no known workarounds. For details, see the GitHub security advisory at https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x and the release notes at https://github.com/cisco/openh264/releases/tag/v2.6.0.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Heap overflow in OpenH264 decoder enables remote code execution via crafted malicious video bitstream processed by victim client application, directly mapping to Exploitation for Client Execution.