How severe is GHSA-5pmw-9j92-3c4c?

No CVSS score has been assigned to GHSA-5pmw-9j92-3c4c yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5pmw-9j92-3c4c?

GHSA-5pmw-9j92-3c4c affects the following packages: openh264-sys2 (crates.io). Ecosystems affected: crates.io.

How do I fix GHSA-5pmw-9j92-3c4c?

Update openh264-sys2 to 0.8.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5pmw-9j92-3c4c is resolved across your whole dependency graph.

How do I detect GHSA-5pmw-9j92-3c4c in my crates.io dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openh264-sys2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-5pmw-9j92-3c4c if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is GHSA-5pmw-9j92-3c4c actively exploited in the wild?

No public exploit code has been indexed for GHSA-5pmw-9j92-3c4c yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-5pmw-9j92-3c4c published, and has it been updated?

GHSA-5pmw-9j92-3c4c was published on February 24, 2025 and was last updated on October 28, 2025. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🦀 crates.io

Not in CISA KEV

OpenH264 Rust API Openh264 Decoding Functions Heap Overflow VulnerabilityGHSA-5pmw-9j92-3c4c

Fix: cisco/openh264#3818

GHSA-5pmw-9j92-3c4c is a remote code execution vulnerability in openh264-sys2. A fix is available for openh264-sys2 — see the affected versions and patch details below.

Also known asRUSTSEC-2025-0008

Published

Feb 24, 2025

Updated

Oct 28, 2025

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 28, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🦀openh264-sys2

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

OpenH264 recently reported a heap overflow that was fixed in upstream 63db555 and integrated into our 0.6.6 release. For users relying on Cisco's pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0.

In other words:

if you rely on our source feature only, >=0.6.6 should be safe,
if you rely on libloading, you must upgrade to 0.8.0 and use their latest DLL >=2.6.0.

Users handling untrusted video files should update immediately.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🦀crates.io	`openh264-sys2`	all versions	0.8.0`cargo update -p openh264-sys2 --precise 0.8.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openh264-sys2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update openh264-sys2 to 0.8.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5pmw-9j92-3c4c is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

OpenH264 recently reported a [heap overflow](https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x) that was fixed in upstream [63db555](https://github.com/cisco/openh264/commit/63db555e30986e3a5f07871368dc90ae78c27449) and [integrated into](https://github.com/ralfbiedert/openh264-rs/commit/3a822fff0b4c9a984622ca2b179fe8898ac54b14) our 0.6.6 release. For users relying on Cisco's pre-compiled DLL, we also published 0.8.0, which is compatible with their latest fixed DLL version 2.6.0. In other words: - if you rely on our `source` feature only, >=0.6.6 should be safe, - if

O3 Security · Impact-Aware SCA

Is GHSA-5pmw-9j92-3c4c in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works