CVE-2023-5129
published 2023-09-25CVE-2023-5129: With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes() function allocates the HuffmanCode buffer…
high7.8
ITW
Exploited in the wild
With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap.
The ReadHuffmanCodes() function allocates the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use.
The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | guacamole | — | — |
| electron | electron | >= 22.0.0 < 22.3.24 | 22.3.24 |
| electron | electron | >= 24.0.0 < 24.8.3 | 24.8.3 |
| electron | electron | >= 25.0.0 < 25.8.1 | 25.8.1 |
| electron | electron | >= 26.0.0 < 26.2.1 | 26.2.1 |
| electron | electron | >= 27.0.0-beta.1 < 27.0.0-beta.2 | 27.0.0-beta.2 |
| github.com | chai2010_webp | >= 0 < 0.0.0-20250406010349-76805d5a8860 | 0.0.0-20250406010349-76805d5a8860 |
| github.com | chai2010_webp | >= 0.0.0 < 1.1.2-0.20250406010349-76805d5a8860 | 1.1.2-0.20250406010349-76805d5a8860 |
| github.com | chai2010_webp | >= 1.1.2 < 1.4.0 | 1.4.0 |
| microsoft | webp_image_extension | >= 0 < 0.2.6 | 0.2.6 |
| mozilla | firefox | — | — |
| platform | external_webp | >= 11:0 < 11:2023-10-06 | 11:2023-10-06 |
| platform | external_webp | >= 12:0 < 12:2023-10-06 | 12:2023-10-06 |
| platform | external_webp | >= 12L:0 < 12L:2023-10-06 | 12L:2023-10-06 |
| platform | external_webp | >= 13:0 < 13:2023-10-06 | 13:2023-10-06 |
| platform | external_webp | >= 14-next:0 < 14-next:2023-10-06 | 14-next:2023-10-06 |
| python | pillow | >= 0 < 10.0.1 | 10.0.1 |
CVSS provenance
ghsa8.8HIGH
osv8.8HIGH