Read the docs
TI-2023-01881 Aliases CVE-2023-1999GHSA-8x9p-cw2c-6253

Use after free in libwebp

Priority LOW 35CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00952 61st percentileScored 2026-11-07
Fix Partial libwebp (Chromium): 1.3.1, 1.3.0-8-ga486d800Red Hat: 24 advisoriesRed Hat: 16 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Chromiumlibwebp0.4.2 to before 1.3.1; 0.4.2 to before 1.3.0-8-ga486d8001.3.1, 1.3.0-8-ga486d800Patch availableCNA
  • libwebp VendorChromium Affected 0.4.2 to before 1.3.1; 0.4.2 to before 1.3.0-8-ga486d800 Fixed in 1.3.1, 1.3.0-8-ga486d800 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*0.4.2 to before 1.3.1VulnerableWebmproject
  • cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:* Versions 0.4.2 to before 1.3.1 Vulnerable ·Webmproject

Remediation

  • Fix · CNA libwebp (Chromium) Fixed in 1.3.1, 1.3.0-8-ga486d800

Red Hat 24 advisories

  • RHSA-2023:2085 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) libwebp-1.0.0-7.el8_6, libwebp-devel-1.0.0-7.el8_6
  • RHSA-2023:2084 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) libwebp-1.0.0-7.el8_4, libwebp-devel-1.0.0-7.el8_4
  • RHSA-2023:2078 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux AppStream (v. 9) libwebp-1.2.0-6.el9_1, libwebp-devel-1.2.0-6.el9_1
Show 21 more Red Hat advisories
  • RHSA-2023:2077 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux Client (v. 7) libwebp-0.3.0-11.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) libwebp-devel-0.3.0-11.el7, libwebp-java-0.3.0-11.el7, libwebp-tools-0.3.0-11.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libwebp-devel-0.3.0-11.el7, libwebp-java-0.3.0-11.el7, libwebp-tools-0.3.0-11.el7
    • Red Hat Enterprise Linux Server (v. 7) libwebp-0.3.0-11.el7, libwebp-0.3.0-11.el7.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7) libwebp-devel-0.3.0-11.el7, libwebp-devel-0.3.0-11.el7.ppc, libwebp-java-0.3.0-11.el7 +1
    • Red Hat Enterprise Linux Workstation (v. 7) libwebp-0.3.0-11.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libwebp-devel-0.3.0-11.el7, libwebp-java-0.3.0-11.el7, libwebp-tools-0.3.0-11.el7
  • RHSA-2023:2076 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux AppStream (v. 8) libwebp-1.0.0-8.el8_7, libwebp-devel-1.0.0-8.el8_7
  • RHSA-2023:2075 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) libwebp-1.2.0-5.el9_0, libwebp-devel-1.2.0-5.el9_0
  • RHSA-2023:2073 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) libwebp-1.0.0-5.2.el8_1, libwebp-devel-1.0.0-5.2.el8_1
  • RHSA-2023:2072 Released 2023-05-02 · Red Hat rating Important
    libwebp security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libwebp-1.0.0-7.el8_2, libwebp-devel-1.0.0-7.el8_2
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) libwebp-1.0.0-7.el8_2, libwebp-devel-1.0.0-7.el8_2
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) libwebp-1.0.0-7.el8_2, libwebp-devel-1.0.0-7.el8_2
  • RHSA-2023:1806 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux Client (v. 7) thunderbird-102.10.0-2.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-102.10.0-2.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) thunderbird-102.10.0-2.el7_9
  • RHSA-2023:1810 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) thunderbird-102.10.0-2.el9_0
  • RHSA-2023:1811 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) thunderbird-102.10.0-2.el8_6
  • RHSA-2023:1809 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-102.10.0-2.el9_1
  • RHSA-2023:1804 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird-102.10.0-2.el8_4
  • RHSA-2023:1805 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird-102.10.0-2.el8_2
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) thunderbird-102.10.0-2.el8_2
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) thunderbird-102.10.0-2.el8_2
  • RHSA-2023:1802 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-102.10.0-2.el8_7
  • RHSA-2023:1803 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-102.10.0-2.el8_1
  • RHSA-2023:1791 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux Client (v. 7) firefox-102.10.0-1.el7_9
    • Red Hat Enterprise Linux Client Optional (v. 7) firefox-102.10.0-1.el7_9
    • Red Hat Enterprise Linux Server (v. 7) firefox-102.10.0-1.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) firefox-102.10.0-1.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) firefox-102.10.0-1.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-102.10.0-1.el7_9
  • RHSA-2023:1790 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) firefox-102.10.0-1.el8_4
  • RHSA-2023:1788 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) firefox-102.10.0-1.el8_6
  • RHSA-2023:1792 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) firefox-102.10.0-1.el8_1
  • RHSA-2023:1787 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-102.10.0-1.el8_7
  • RHSA-2023:1789 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-102.10.0-1.el8_2
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) firefox-102.10.0-1.el8_2
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) firefox-102.10.0-1.el8_2
  • RHSA-2023:1786 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-102.10.0-1.el9_1, firefox-x11-102.10.0-1.el9_1
  • RHSA-2023:1785 Released 2023-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) firefox-102.10.0-1.el9_0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:1787, RHSA-2023:1802, RHSA-2023:2076
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:1786, RHSA-2023:1809, RHSA-2023:2078
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:1789, RHSA-2023:1805, RHSA-2023:2072
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2023:1792, RHSA-2023:1803, RHSA-2023:2073
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:1789, RHSA-2023:1805, RHSA-2023:2072
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1790, RHSA-2023:1804, RHSA-2023:2084
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1788, RHSA-2023:1811, RHSA-2023:2085
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:1785, RHSA-2023:1810, RHSA-2023:2075
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:1789, RHSA-2023:1805, RHSA-2023:2072
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2023:1791, RHSA-2023:1806, RHSA-2023:2077
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2023:1791, RHSA-2023:2077
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2023:2077
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2023:1791, RHSA-2023:2077
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2023:1791, RHSA-2023:1806, RHSA-2023:2077
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:1791, RHSA-2023:1806, RHSA-2023:2077
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2023:1791, RHSA-2023:2077

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1999
  2. 2026-10-03 Alias added: GHSA-8x9p-cw2c-6253

References

Other 2

  • TI-2023-01445 Use after free in Google Chrome CVSS 3.1HIGH 8.8
  • TI-2017-04706 Memory corruption in Apple SQLite CVSS 3.0HIGH 8.8
  • TI-2015-01084 Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers… CVSS 2.0HIGH 7.5
  • TI-2014-06607 The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory… CVSS 2.0HIGH 7.5
  • TI-2015-01225 Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google… CVSS 2.0HIGH 7.5
  • TI-2024-04823 Integer overflow in libvpx CVSS 4.0MEDIUM 5.9
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences