Null-Dereference READ Vulnerability in libwebp
Summary
OSV-2025-627: Null-dereference READ in ProcessRows. Affects libwebp versions >= 2246828be3329e26d8c0774481e98b0315872110, < 61e5c391d6609666983edcf9ad97dd0ebd70b501. Fixed in 61e5c391d6609666983edcf9ad97dd0ebd70b501. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwebp is an open-source library developed by Google for encoding and decoding images in the WebP format. It provides a range of features, including lossless and lossy compression, making it a popular choice for web developers looking to optimize image loading times. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as OSV-2025-627 is a null-dereference read issue occurring in the libwebp library. This flaw arises during the processing of image data, specifically in the ProcessRows function, which can lead to a crash when the library attempts to read from a null pointer. The origin of this vulnerability is linked to improper handling of image data, which can result in unexpected behavior and potential denial of service. If exploited, this vulnerability could allow an attacker to disrupt the normal operation of applications relying on libwebp for image processing.
How To Fix
Minimum fixed version
61e5c391d6609666983edcf9ad97dd0ebd70b501
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The null-dereference read vulnerability in libwebp poses a significant risk to applications that utilize this library for image processing. It is crucial for developers to update to the patched version to ensure the security and stability of their applications. Regular monitoring and updating of dependencies can help prevent similar vulnerabilities in the future.
See every vulnerability recorded for libwebp →
FAQ
A null-dereference read vulnerability occurs when a program attempts to read data from a memory location that has not been allocated or is null, leading to crashes or unexpected behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can determine if your application is affected.
The primary consequence is a denial of service, where the application may crash or become unresponsive when processing certain image data.
The best prevention method is to update to the patched version of libwebp as soon as it becomes available. Regularly updating dependencies can help mitigate such vulnerabilities.
Detailed information can be found in the OSS-Fuzz report linked in the vulnerability details, as well as on the official libwebp GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
