# CVE-2025-27091: libopenh264-8: OpenH264 is a free license codec library which supports H.264 encoding anddecoding

CVE-2025-27091 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2025-27091, released February 20, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-27091
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.0069
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 20, 2025

## Description

OpenH264 is a free license codec library which supports H.264 encoding anddecoding. A vulnerability in the decoding functions of OpenH264 codeclibrary could allow a remote, unauthenticated attacker to trigger a heapoverflow. This vulnerability is due to a race condition between a SequenceParameter Set (SPS) memory allocation and a subsequent non InstantaneousDecoder Refresh (non-IDR) Network Abstraction Layer (NAL) unit memoryusage. An attacker could exploit this vulnerability by crafting a maliciousbitstream and tricking a victim user into processing an arbitrary videocontaining the malicious bistream. An exploit could allow the attacker tocause an unexpected crash in the victim's user decoding client and,possibly, perform arbitrary commands on the victim's host by abusing theheap overflow. This vulnerability affects OpenH264 2.5.0 and earlierreleases. Both Scalable Video Coding (SVC) mode and Advanced Video Coding(AVC) mode are affected by this vulnerability. OpenH264 software releases2.6.0 and later contained the fix for this vulnerability. Users are advisedto upgrade. There are no known workarounds for this vulnerability.### For more informationIf you have any questions or comments about this advisory:* [Open an issue incisco/openh264](https://github.com/cisco/openh264/issues)* Email Cisco Open Source Security([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT([psirt@cisco.com](mailto:psirt@cisco.com))### Credits:* **Research:** Octavian Guzu and Andrew Calvano of Meta* **Fix ideation:** Philipp Hancke and Shyam Sadhwani of Meta* **Fix implementation:** Benzheng Zhang (@BenzhengZhang)* **Release engineering:** Benzheng Zhang (@BenzhengZhang)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libopenh264-8 Ubuntu 25.04 (plucky) | 2.6.0+dfsg-1 | [libopenh264-8 2.6.0+dfsg-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libopenh264-8-2.6.0-dfsg-1.md) | Jan 16, 2026 |
| Linux | libopenh264-cisco8 Ubuntu 25.04 (plucky) | 2.6.0+dfsg-1 | [libopenh264-cisco8 2.6.0+dfsg-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libopenh264-cisco8-2.6.0-dfsg-1.md) | Jan 16, 2026 |
| Linux | openh264 Debian 12.15 (bookworm) | 2.3.1+dfsg-3+deb12u1 | [DSA-5870-1](https://patchblox.com/security/data/fix/linux/dsa-5870-1.md) | Feb 26, 2025 |
| Linux | openh264 Debian 13.5 (trixie) | 2.5.0+dfsg-2 | [DEBIAN-CVE-2025-27091](https://patchblox.com/security/data/fix/linux/debian-cve-2025-27091.md) | Feb 20, 2025 |
| Linux | openh264 Debian 14 | 2.5.0+dfsg-2 | [DEBIAN-CVE-2025-27091](https://patchblox.com/security/data/fix/linux/debian-cve-2025-27091.md) | Feb 20, 2025 |

---

Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.