VYPR
← All advisories
Unrated severityNVD Advisory· Published May 21, 2021· Updated Aug 5, 2024

CVE-2018-25009

CVE-2018-25009

Description

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-based buffer over-read in libwebp before 1.0.1's WebPMuxCreateInternal could lead to information disclosure via crafted WebP files.

Vulnerability

A heap-based buffer over-read vulnerability exists in libwebp versions prior to 1.0.1 in GetLE16(), specifically triggered during parsing of the VP8X chunk in WebPMuxCreateInternal. The function does not properly check the available size before reading data, allowing an out-of-bounds read on heap memory [1][2].

Exploitation

An attacker must supply a crafted WebP file with a malicious VP8X chunk that exploits the missing size check. No authentication or special permissions are required; the attacker only needs to induce a target application using libwebp (e.g., a web browser, image viewer, or processing tool) to parse the malformed file [1][2].

Impact

Successful exploitation results in an out-of-bounds heap read, which can lead to information disclosure of adjacent memory contents. In some cases, this could expose sensitive data or aid in further attacks. The vulnerability does not directly allow remote code execution but may lower security boundaries by leaking memory [1][2].

Mitigation

The issue is fixed in libwebp version 1.0.1, released on 2018-07-03. Users should update to 1.0.1 or later [2]. Red Hat and other distributions have released updated packages [1]. There is no known workaround other than applying the patch; no evidence indicates inclusion in CISA KEV.

References
  1. 1956917 – (CVE-2018-25009) CVE-2018-25009 libwebp: out-of-bounds read in WebPMuxCreateInternal
  2. 95fd65070662e01cc9170c4444f5c0859a710097 - webm/libwebp - Git at Google

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

37

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.