Null-Dereference READ Vulnerability in libwebp
Summary
OSV-2025-628: Null-dereference READ in ubsan_GetStackTrace. Affects libwebp versions >= 2246828be3329e26d8c0774481e98b0315872110, < 61e5c391d6609666983edcf9ad97dd0ebd70b501. Fixed in 61e5c391d6609666983edcf9ad97dd0ebd70b501. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwebp is an open-source library developed by Google for encoding and decoding images in the WebP format. It is designed to provide high-quality image compression while maintaining a small file size, making it ideal for web use. The library is widely used in various applications and platforms due to its efficiency and performance. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as OSV-2025-628 is a Null-dereference READ error occurring in the function ubsan_GetStackTrace. This issue arises from improper handling of null pointers, which can lead to crashes and potential exploitation. The vulnerability was reported through OSS-Fuzz, highlighting its impact on the stability and reliability of applications utilizing the libwebp library. If exploited, this vulnerability could result in application crashes, affecting user experience and potentially leading to further security issues.
How To Fix
Minimum fixed version
61e5c391d6609666983edcf9ad97dd0ebd70b501
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as possible to avoid potential crashes.
Conclusion
The Null-dereference READ vulnerability in libwebp poses a significant risk to applications utilizing this library. It is crucial for developers to update to the patched version to ensure the stability and security of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software integrity.
See every vulnerability recorded for libwebp →
FAQ
A Null-dereference READ vulnerability occurs when a program attempts to read memory at a location that is not valid, often due to a null pointer. This can lead to crashes and security issues.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The primary consequence is application crashes, which can disrupt user experience. In some cases, it may also lead to further security vulnerabilities if exploited.
Yes, you should upgrade to the patched version 61e5c391d6609666983edcf9ad97dd0ebd70b501 to mitigate this vulnerability.
OSS-Fuzz is a service provided by Google that helps find vulnerabilities in open-source software by running continuous fuzz testing. It reports issues like the one found in libwebp.
References
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
