Uninitialized Value Vulnerability in libwebp: AlphaReplace_SSE2 Crash Risk
Summary
OSV-2025-855: Use-of-uninitialized-value in AlphaReplace_SSE2. Affects libwebp versions >= 0d14d84bdb79f06ec6b23f4425138a1d8a5637de, < 2a755e7eecd2f167a5e150551bbdbaa2c4273b84. Fixed in 2a755e7eecd2f167a5e150551bbdbaa2c4273b84. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwebp is an open-source library developed by Google for encoding and decoding images in the WebP format. It is designed to provide high-quality lossy and lossless compression for images, making it a popular choice for web developers looking to optimize image loading times. However, like many software libraries, libwebp is susceptible to vulnerabilities that can compromise its functionality and security. The specific vulnerability in question arises from the use of uninitialized values in the AlphaReplace_SSE2 function, which can lead to crashes and unexpected behavior.
Vulnerability Detail
The vulnerability identified in libwebp is a use-of-uninitialized-value issue that occurs within the AlphaReplace_SSE2 function. This flaw can lead to crashes during the execution of the WebPReplaceTransparentPixels and WebPEncode functions. The origin of this vulnerability was reported through OSS-Fuzz, highlighting the importance of rigorous testing and validation in software development. If exploited, this vulnerability could result in application crashes, potentially impacting user experience and system stability.
How To Fix
Minimum fixed version
2a755e7eecd2f167a5e150551bbdbaa2c4273b84
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the AlphaReplace_SSE2 function until they have updated to the patched version. Additionally, ensuring that input data is properly initialized before processing can help mitigate the risk of crashes.
Conclusion
The use-of-uninitialized-value vulnerability in libwebp's AlphaReplace_SSE2 function poses a risk of application crashes. It is crucial for users to update to the patched version to ensure stability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libwebp →
FAQ
The vulnerability is a use-of-uninitialized-value issue that can lead to application crashes.
You can use Vulert's playground to check if your application is affected without any signup required.
Exploiting this vulnerability can lead to application crashes, impacting user experience and system stability.
Yes, a patched version of libwebp is available. Users should update to version 2a755e7eecd2f167a5e150551bbdbaa2c4273b84.
As a temporary measure, avoid using the affected function and ensure that input data is properly initialized.
References
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
