Webp Image Extension
Monthly
Heap-based buffer overflow in Microsoft WebP Image Extension versions prior to 1.2.31.0 enables remote code execution when a victim opens a specially crafted WebP image file. The root trigger is an integer overflow (CWE-190) that corrupts heap allocation sizing, producing a classic CWE-122 heap overflow; the CVSS vector confirms full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS score (8.8) and complete code-execution impact make patching urgent for any Windows environment where the extension is installed.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WebP Image Extensions Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Heap-based buffer overflow in Microsoft WebP Image Extension versions prior to 1.2.31.0 enables remote code execution when a victim opens a specially crafted WebP image file. The root trigger is an integer overflow (CWE-190) that corrupts heap allocation sizing, producing a classic CWE-122 heap overflow; the CVSS vector confirms full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS score (8.8) and complete code-execution impact make patching urgent for any Windows environment where the extension is installed.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WebP Image Extensions Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.