CVE-2026-16436: RUSTSEC-2023-0060 - libwebp: OOB write in BuildHuffmanTable

CVE-2026-16436 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2023-09-12

libwebp is a widely-used image compression library that processes WebP image files across browsers, image editors, and productivity software. A heap buffer overflow vulnerability in the image decoding logic allows attackers to trigger an out-of-bounds memory write by sending a specially crafted WebP image, potentially enabling code execution or application crashes.

Technologies: webp (crates.io), electron (npm), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q8-x64 (NuGet), pillow (PyPI). Vendors: crates.io, Go, Google, npm, NuGet, PyPI.

Quick answers

Is CVE-2026-16436 exploited in the wild?
Yes. CVE-2026-16436 is known to be exploited in the wild, first recorded on 13 September 2023. Treat it as urgent.
How severe is CVE-2026-16436?
Critical severity, with a CVSS score of 3.1, published 12 September 2023.
Which products and versions are affected?
libwebp-sys (crates.io) SEMVER:introduced=0,fixed=0.9.3, SEMVER:introduced=0.0.0-0,fixed=0.9.3; libwebp-sys2 (crates.io) SEMVER:introduced=0,fixed=0.1.8, SEMVER:introduced=0.0.0-0,fixed=0.1.8; webp (crates.io) SEMVER:introduced=0,fixed=0.2.6; github.com/chai2010/webp (Go) SEMVER:introduced=1.1.2,fixed=1.4.0; and 9 more.
Is there a fix for CVE-2026-16436?
Yes. libwebp-sys (crates.io): upgrade to 0.9.3 or later; libwebp-sys2 (crates.io): upgrade to 0.1.8 or later; webp (crates.io): upgrade to 0.2.6 or later; github.com/chai2010/webp (Go): upgrade to 1.4.0 or later; electron (npm): upgrade to 22.3.24 or later; Magick.NET-Q16-AnyCPU (NuGet): upgrade to 13.3.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 13.3.0 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 13.3.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 13.3.0 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 13.3.0 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 13.3.0 or later; SkiaSharp (NuGet): upgrade to 2.88.6 or later; pillow (PyPI): upgrade to 10.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16436 attacked?
It is attacked over the network.
Am I affected by CVE-2026-16436?
Check whether you run libwebp-sys (crates.io), libwebp-sys2 (crates.io), webp (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • libwebp-sys (crates.io): upgrade to 0.9.3 or later
    cargo update -p libwebp-sys
  • libwebp-sys2 (crates.io): upgrade to 0.1.8 or later
    cargo update -p libwebp-sys2
  • webp (crates.io): upgrade to 0.2.6 or later
    cargo update -p webp
  • github.com/chai2010/webp (Go): upgrade to 1.4.0 or later
    go get github.com/chai2010/webp@v1.4.0
  • electron (npm): upgrade to 22.3.24 or later
    npm install electron@22.3.24
  • Magick.NET-Q16-AnyCPU (NuGet): upgrade to 13.3.0 or later
    dotnet add package Magick.NET-Q16-AnyCPU --version 13.3.0
  • Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 13.3.0 or later
    dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 13.3.0
  • Magick.NET-Q16-x64 (NuGet): upgrade to 13.3.0 or later
    dotnet add package Magick.NET-Q16-x64 --version 13.3.0
  • Magick.NET-Q8-AnyCPU (NuGet): upgrade to 13.3.0 or later
    dotnet add package Magick.NET-Q8-AnyCPU --version 13.3.0
  • Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 13.3.0 or later
    dotnet add package Magick.NET-Q8-OpenMP-x64 --version 13.3.0
  • Magick.NET-Q8-x64 (NuGet): upgrade to 13.3.0 or later
    dotnet add package Magick.NET-Q8-x64 --version 13.3.0
  • SkiaSharp (NuGet): upgrade to 2.88.6 or later
    dotnet add package SkiaSharp --version 2.88.6
  • pillow (PyPI): upgrade to 10.0.1 or later
    pip install "pillow>=10.0.1"

Technical details

A heap buffer overflow vulnerability (CWE-787) exists in the BuildHuffmanTable function within libwebp's image decoding logic. The vulnerability is triggered when processing a malicious WebP image, where insufficient bounds checking allows an attacker to write data beyond allocated heap memory. The attack requires no authentication and can be triggered remotely by embedding a crafted WebP image in an HTML page or sending it directly to an application that processes WebP files. An attacker can achieve out-of-bounds memory corruption, potentially leading to code execution or denial of service. The vulnerability was patched in libwebp versions 1.3.2 and later, with corresponding fixes released in dependent packages such as libwebp-sys (0.9.3+) and libwebp-sys2 (0.1.8+).

Affected products

  • Google libwebp before 1.3.2
  • Rust libwebp-sys2 contributors libwebp-sys2 before 0.1.8
  • Rust libwebp-sys contributors libwebp-sys before 0.9.3

Identifiers

  • CVE-2026-16436
  • CVE-2023-4863
  • CVE-2026-16437
  • CVE-2026-16438
  • GHSA-j7hp-h8jx-5ppr
  • PYSEC-2026-1794
  • RUSTSEC-2023-0060
  • RUSTSEC-2023-0061

Timeline

  • 2023-09-12: disclosed: Vulnerability published as CVE-2023-4863
  • 2023-09-12: patched: libwebp version 1.3.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.