GHSA-5pmw-9j92-3c4c: OpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability
OpenH264 recently reported a heap overflow that was fixed in upstream 63db555 and integrated into our 0.6.6 release. For users relying on Cisco’s pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0.
In other words:
- if you rely on our
source
feature only, >=0.6.6 should be safe, - if you rely on
libloading
, you must upgrade to 0.8.0 and use their latest DLL >=2.6.0.
Users handling untrusted video files should update immediately.
References
Detect and mitigate GHSA-5pmw-9j92-3c4c with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →