Libwebp is a library for encoding and decoding WebP images; vulnerabilities can let crafted images trigger code execution in dependent software.
Search across headline titles and summaries.
Background for this topic.
Libwebp is an open-source codec library that encodes and decodes images in the WebP format. It is embedded in browsers, operating systems, image editors, messaging software, and server-side media-processing components, so a vulnerability in the library can affect applications that do not expose “Libwebp” as a visible product.
Its security relevance is the parsing of attacker-controlled image data. Bugs such as integer errors, out-of-bounds access, or heap buffer overflows in a decoder may cause a crash and, in some application contexts, enable arbitrary code execution. Image uploads, thumbnails, previews, and automatic media conversion are common attack surfaces. Practitioners should inventory direct and transitive Libwebp dependencies, track upstream security advisories and fixed versions, and ensure applications reject malformed files or isolate decoding where practical. Patching only a browser or operating system may not update separately bundled copies used by backend services or command-line tools.
Weekly headline count for the current query.
The WebP vulnerability affects multiple browsers besides Firefox and Thunderbird, with active exploitation ongoing.