CoreCVE
Back

HIGH

Use after free in libwebp

Published Jun 20, 2023

Description

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.

Affected products

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (2)

CWE-415

CWE-416

Use After Free

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Google
Published Jun 20, 2023
Updated Feb 13, 2025
Reserved Apr 12, 2023
Link CVE-2023-1999
CISA Vulnrichment
Updated Sep 26, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2023-1999
Red Hat
Severity Important
Public date Apr 11, 2023
Links CVE-2023-1999 - Bugzilla
ENISA EUVD
Assigner Google
Published Jun 20, 2023
Updated Feb 13, 2025
Exploited since n/a
Link EUVD-2023-24179
EUVD-2023-24179