CVE-2025-27091

What it actually does

Race condition between SPS memory allocation and subsequent non-IDR NAL unit usage in OpenH264 decoding functions triggers heap overflow when processing crafted bitstreams in both SVC and AVC modes.

Why it matters to the business

Video decoding clients in ecosystems with 98 downstream dependents face crashes or potential arbitrary command execution, disrupting operations and exposing hosts to compromise with no known ransomware campaigns observed.

How an attack unfolds

Attacker crafts malicious H.264 bitstream exploiting the SPS/non-IDR race condition, delivers it in a video file, and tricks the victim into decoding it in an affected OpenH264 client up to version 2.5.0.

How to fix it

Upgrade to OpenH264 2.6.0 or later; for affected packages apply tensorflow (Bitnami) 2.1.4 or cisco/openh264 commit 652bdb7719f30b52b08e506645a7322ff1b2cc6f. No workarounds exist.

How to confirm the fix worked

Confirm installed OpenH264 version is 2.6.0 or newer via library metadata or package manager; reprocess known test vectors post-upgrade to verify absence of overflow.

Typical attack path

1. Craft malicious bitstream targeting the race condition
2. Embed bitstream in video file and distribute to victim
3. Victim processes the video in vulnerable decoder
4. Trigger race between SPS allocation and NAL usage
5. Exploit resulting heap overflow for crash or code execution

How to detect it

Review application logs for OpenH264 decoder crashes during video processing; inspect heap allocation patterns around SPS and NAL handling in affected versions.

What your security team should do

• Immediately upgrade all OpenH264 instances and dependents to fixed versions
• Scan build pipelines and containers for versions 2.5.0 and earlier
• Monitor video decoding processes for unexpected crashes
• Track EPSS and ecosystem prevalence for prioritization