Null-Dereference READ Vulnerability in libwebp: Critical Crash Risk
Summary
OSV-2025-631: Null-dereference READ in advanced_api_fuzzer@AdvancedApi.AdvancedApiTest. Affects libwebp versions >= 2246828be3329e26d8c0774481e98b0315872110, < 61e5c391d6609666983edcf9ad97dd0ebd70b501. Fixed in 61e5c391d6609666983edcf9ad97dd0ebd70b501. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwebp is an open-source library developed by Google for encoding and decoding images in the WebP format. It is widely used for its efficient compression and high-quality image output. However, like any software, it can be susceptible to vulnerabilities that may compromise its stability and security. The specific vulnerability in question relates to a null-dereference issue that can lead to application crashes when using certain advanced API functions.
Vulnerability Detail
The vulnerability identified as OSV-2025-631 is a null-dereference READ that occurs in the advanced_api_fuzzer component of libwebp. This issue arises when the application attempts to read from a null pointer, leading to a crash. The vulnerability was reported through OSS-Fuzz, highlighting its potential impact on applications that rely on libwebp for image processing. If exploited, this could result in application instability and a poor user experience.
How To Fix
Minimum fixed version
61e5c391d6609666983edcf9ad97dd0ebd70b501
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is recommended to update to the patched version as soon as possible to mitigate the risk of crashes.
Conclusion
The null-dereference READ vulnerability in libwebp poses a significant risk of application crashes. Users are strongly advised to update to the latest patched version to ensure stability and security. Regular monitoring of dependencies using tools like Vulert can help in identifying and mitigating such vulnerabilities promptly.
See every vulnerability recorded for libwebp →
FAQ
A null-dereference READ vulnerability occurs when a program attempts to read data from a memory address that is null, leading to crashes or undefined behavior.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary consequence is application crashes, which can lead to a poor user experience and potential data loss.
The best prevention is to keep your libraries updated to the latest versions that include security patches.
If an immediate update is not possible, consider reviewing your code to avoid using the affected API functions until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
