{
  "cveId": "CVE-2025-27091",
  "url": "https://patchblox.com/security/cve/CVE-2025-27091",
  "summary": "CVE-2025-27091 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2025-27091, released February 20, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "libopenh264-8: OpenH264 is a free license codec library which supports H.264 encoding anddecoding",
  "description": "OpenH264 is a free license codec library which supports H.264 encoding anddecoding. A vulnerability in the decoding functions of OpenH264 codeclibrary could allow a remote, unauthenticated attacker to trigger a heapoverflow. This vulnerability is due to a race condition between a SequenceParameter Set (SPS) memory allocation and a subsequent non InstantaneousDecoder Refresh (non-IDR) Network Abstraction Layer (NAL) unit memoryusage. An attacker could exploit this vulnerability by crafting a maliciousbitstream and tricking a victim user into processing an arbitrary videocontaining the malicious bistream. An exploit could allow the attacker tocause an unexpected crash in the victim\u0027s user decoding client and,possibly, perform arbitrary commands on the victim\u0027s host by abusing theheap overflow. This vulnerability affects OpenH264 2.5.0 and earlierreleases. Both Scalable Video Coding (SVC) mode and Advanced Video Coding(AVC) mode are affected by this vulnerability. OpenH264 software releases2.6.0 and later contained the fix for this vulnerability. Users are advisedto upgrade. There are no known workarounds for this vulnerability.### For more informationIf you have any questions or comments about this advisory:* [Open an issue incisco/openh264](https://github.com/cisco/openh264/issues)* Email Cisco Open Source Security([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT([psirt@cisco.com](mailto:psirt@cisco.com))### Credits:* **Research:** Octavian Guzu and Andrew Calvano of Meta* **Fix ideation:** Philipp Hancke and Shyam Sadhwani of Meta* **Fix implementation:** Benzheng Zhang (@BenzhengZhang)* **Release engineering:** Benzheng Zhang (@BenzhengZhang)",
  "published": "2025-02-20T18:15:26Z",
  "severity": "Medium",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.00687,
  "epssPercentile": 0.52948,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libopenh264-8",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "2.6.0\u002Bdfsg-1",
      "fix": "libopenh264-8 2.6.0\u002Bdfsg-1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libopenh264-8-2.6.0-dfsg-1",
      "released": "2026-01-16T01:42:25Z"
    },
    {
      "platform": "linux",
      "product": "libopenh264-cisco8",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "2.6.0\u002Bdfsg-1",
      "fix": "libopenh264-cisco8 2.6.0\u002Bdfsg-1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libopenh264-cisco8-2.6.0-dfsg-1",
      "released": "2026-01-16T01:42:25Z"
    },
    {
      "platform": "linux",
      "product": "openh264",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.3.1\u002Bdfsg-3\u002Bdeb12u1",
      "fix": "DSA-5870-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5870-1",
      "released": "2025-02-26T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openh264",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.5.0\u002Bdfsg-2",
      "fix": "DEBIAN-CVE-2025-27091",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-27091",
      "released": "2025-02-20T18:15:26Z"
    },
    {
      "platform": "linux",
      "product": "openh264",
      "release": "Debian 14",
      "fixedVersion": "2.5.0\u002Bdfsg-2",
      "fix": "DEBIAN-CVE-2025-27091",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-27091",
      "released": "2025-02-20T18:15:26Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}