Executive brief
libwebp is a widely-used image compression library that processes WebP image files across browsers, image editors, and productivity software. A heap buffer overflow vulnerability in the image decoding logic allows attackers to trigger an out-of-bounds memory write by sending a specially crafted WebP image, potentially enabling code execution or application crashes.
Technical details
A heap buffer overflow vulnerability (CWE-787) exists in the BuildHuffmanTable function within libwebp's image decoding logic. The vulnerability is triggered when processing a malicious WebP image, where insufficient bounds checking allows an attacker to write data beyond allocated heap memory. The attack requires no authentication and can be triggered remotely by embedding a crafted WebP image in an HTML page or sending it directly to an application that processes WebP files. An attacker can achieve out-of-bounds memory corruption, potentially leading to code execution or denial of service. The vulnerability was patched in libwebp versions 1.3.2 and later, with corresponding fixes released in dependent packages such as libwebp-sys (0.9.3+) and libwebp-sys2 (0.1.8+).
Affected products
- Google libwebp before 1.3.2
- Rust libwebp-sys2 contributors libwebp-sys2 before 0.1.8
- Rust libwebp-sys contributors libwebp-sys before 0.9.3
Timeline
- 2023-09-12: disclosed: Vulnerability published as CVE-2023-4863
- 2023-09-12: patched: libwebp version 1.3.2 released with fix