Use after free in libwebp

Vulnerability

The vulnerability is a use-after-free and double-free in the libwebp library, specifically in the ApplyFiltersAndEncode() function. The issue occurs when an attacker triggers a loop that frees best.bw and assigns best = trial pointer. A subsequent loop returns 0 due to an out-of-memory error in the VP8 encoder, leaving the pointer still assigned to trial, leading to a double free when AddressSanitizer detects it. Affected versions include libwebp prior to 1.3.1_p20230908 [1][2].

Exploitation

An attacker needs to provide a specially crafted WebP image that triggers the vulnerable code path. The exploitation requires no authentication; the victim must decode the malicious image using an application that relies on libwebp. The sequence involves the ApplyFiltersAndEncode() function being called in a loop, where memory is freed and then reused incorrectly due to an out-of-memory condition.

Impact

Successful exploitation could lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The impact is similar to other memory safety issues in image processing libraries, with the worst-case scenario being remote code execution [2].

Mitigation

The fix is included in libwebp version 1.3.1_p20230908 and later. Users should upgrade to this version or later. There is no known workaround [2]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.