Google Chromium WebP Heap-Based Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/09/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/chai2010/webp | ≥ 0.0.0, < 1.1.2-0.20250406010349-76805d5a8860≥ 1.1.2, < 1.4.0< 0.0.0-20250406010349-76805d5a8860 | 1.1.2-0.20250406010349-76805d5a88601.4.00.0.0-20250406010349-76805d5a8860 |
| SkiaSharp | ≥ 2.0.0, < 2.88.6 | 2.88.6 |
| magick.net-q16-anycpu | < 13.3.0 | 13.3.0 |
| magick.net-q16-hdri-anycpu | < 13.3.0 | 13.3.0 |
| magick.net-q16-x64 | < 13.3.0 | 13.3.0 |
| magick.net-q8-anycpu | < 13.3.0 | 13.3.0 |
| magick.net-q8-openmp-x64 | < 13.3.0 | 13.3.0 |
| magick.net-q8-x64 | < 13.3.0 | 13.3.0 |
| pillow | < 10.0.1 | 10.0.1 |
| honeyview | < 5.51 | 5.51 |
| seequent leapfrog | < 2023.2 | 2023.2 |
| chrome | < 116.0.5845.187 | 116.0.5845.187 |
| edge chromium | < 116.0.1938.81 | 116.0.1938.81 |
| teams | < 1.6.00.26463< 1.6.00.26474 | 1.6.00.264631.6.00.26474 |
| webp image extension | < 1.0.62681.0 | 1.0.62681.0 |
| firefox | ≥ 115.1.0, < 115.2.1< 102.15.1< 117.0.1 | 115.2.1102.15.1117.0.1 |
| thunderbird | ≥ 115.0, < 115.2.2< 102.15.1 | 115.2.2102.15.1 |
| libwebp | < 1.3.2 | 1.3.2 |
| libwebp-sys | < 0.9.3 | 0.9.3 |
| libwebp-sys2 | < 0.1.8 | 0.1.8 |
| webp | < 0.2.6 | 0.2.6 |
| electron | ≥ 22.0.0, < 22.3.24≥ 24.0.0, < 24.8.3≥ 25.0.0, < 25.8.1≥ 26.0.0, < 26.2.1≥ 27.0.0-beta.1, < 27.0.0-beta.2 | 22.3.2424.8.325.8.126.2.127.0.0-beta.2 |
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free