CVE-2018-25011
📋 TL;DR
A heap-based buffer overflow vulnerability in libwebp's PutLE16() function allows attackers to execute arbitrary code or cause denial of service. This affects any application that processes WebP images using vulnerable libwebp versions, including web browsers, image editors, and media libraries. The vulnerability is remotely exploitable via specially crafted WebP images.
💻 Affected Systems
- libwebp
- Google Chrome
- Mozilla Firefox
- Android
- iOS
- macOS
- Linux distributions with libwebp packages
- ImageMagick
- GIMP
- other applications using libwebp
📦 What is this software?
Libwebp by Webmproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application processing the WebP image, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited code execution within the application's context.
If Mitigated
Application crash with no further impact if proper sandboxing or privilege separation is implemented.
🎯 Exploit Status
Proof-of-concept code exists in public bug reports. The vulnerability requires processing a malicious WebP image, which can be delivered via websites, emails, or files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libwebp 1.0.1 and later
Vendor Advisory: https://chromium.googlesource.com/webm/libwebp/+/v1.0.1
Restart Required: Yes
Instructions:
1. Update libwebp to version 1.0.1 or later. 2. Update all applications that bundle libwebp (e.g., web browsers, image editors). 3. Restart affected applications and services.
🔧 Temporary Workarounds
Disable WebP image processing
allTemporarily disable WebP image support in applications if possible
Application-specific configuration changes required
Use system package manager to update
linuxUpdate libwebp package through system package manager
sudo apt update && sudo apt upgrade libwebp
sudo yum update libwebp
brew upgrade webp
🧯 If You Can't Patch
- Implement strict input validation for WebP images
- Run vulnerable applications in sandboxed environments with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check libwebp version: `libwebp --version` or `dpkg -l | grep libwebp` or `rpm -q libwebp`Check Version:
libwebp --versionVerify Fix Applied:
Verify libwebp version is 1.0.1 or later: `libwebp --version | grep -q '1\.0\.[1-9]\|1\.[1-9]\|\s[2-9]' && echo 'Patched' || echo 'Vulnerable'`📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults or memory corruption errors when processing images
- Unexpected process termination in image processing services
Network Indicators:
- Unusual outbound connections from image processing applications
- Large volumes of WebP image requests to vulnerable services
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "buffer overflow" OR "memory corruption") AND process="*webp*"🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9119
- https://bugzilla.redhat.com/show_bug.cgi?id=1956919
- https://chromium.googlesource.com/webm/libwebp/+/v1.0.1
- https://chromium.googlesource.com/webm/libwebp/+log/be738c6d396fa5a272c1b209be4379a7532debfe..29fb8562c60b5a919a75d904ff7366af423f8ab9?pretty=fuller&n=10000
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9119
- https://bugzilla.redhat.com/show_bug.cgi?id=1956919
- https://chromium.googlesource.com/webm/libwebp/+/v1.0.1
- https://chromium.googlesource.com/webm/libwebp/+log/be738c6d396fa5a272c1b209be4379a7532debfe..29fb8562c60b5a919a75d904ff7366af423f8ab9?pretty=fuller&n=10000
