Null-Dereference READ Vulnerability in libwebp: Critical Issue in Image Encoding
Summary
OSV-2025-634: Null-dereference READ in enc_fuzzer@Enc.EncTest. Affects libwebp versions >= 2246828be3329e26d8c0774481e98b0315872110, < 61e5c391d6609666983edcf9ad97dd0ebd70b501. Fixed in 61e5c391d6609666983edcf9ad97dd0ebd70b501. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwebp is an open-source library developed by Google for encoding and decoding images in the WebP format. It is widely used for its ability to provide high-quality images with smaller file sizes compared to traditional formats like JPEG and PNG. However, like any software, it is susceptible to vulnerabilities that can affect its performance and security. This particular vulnerability involves a null-dereference issue that can lead to crashes during the encoding process, specifically when using the fuzzer tool.
Vulnerability Detail
The vulnerability identified as OSV-2025-634 is a null-dereference READ that occurs in the enc_fuzzer function within the libwebp package. This issue arises when the software attempts to read from a null pointer, leading to a crash. The vulnerability was reported through OSS-Fuzz, which is a service that finds security vulnerabilities in open-source software by running fuzz tests. If exploited, this vulnerability could cause applications using libwebp to crash unexpectedly, potentially leading to denial of service.
How To Fix
Minimum fixed version
61e5c391d6609666983edcf9ad97dd0ebd70b501
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the enc_fuzzer tool until the package is updated to the fixed version. Additionally, ensuring that proper error handling is implemented in the code can help mitigate the impact of this vulnerability.
Conclusion
The null-dereference READ vulnerability in libwebp is a critical issue that can lead to application crashes. Users are strongly advised to update to the patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libwebp →
FAQ
A null-dereference READ vulnerability occurs when a program attempts to read data from a memory location that has not been initialized, leading to crashes or undefined behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check if your application is affected without needing to access the code.
The primary consequence of this vulnerability is a crash in applications that utilize the libwebp library, which can lead to denial of service and affect user experience.
While updating to the patched version is the best way to prevent exploitation, implementing robust error handling in your code can also help mitigate risks.
More information can be found in the OSS-Fuzz report linked in the vulnerability details, as well as on the official libwebp GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
