Libwebp
Vendor:
First CVE: Feb 3, 2017 · Active for 9 years
15
Total CVEs
More Total CVEs than 92% of tracked products
3.8
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
8.6
Avg CVSS
Higher Avg CVSS than 76% of tracked products
6.7%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Libwebp over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 3, 2017
9 years ago
Most Recent CVE
Sep 12, 2023
1,046 days ago
CVE Severity & Scoring
Libwebp15 CVEs
27%
67%
All CVEs352,294 CVEs
45%
40%
11%
LowHighCritical
Attack Vector
Local1 (6.7%)
Network14 (93.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low14 (93.3%)
High1 (6.7%)
Unknown0 (0.0%)
User Interaction
None13 (86.7%)
Unknown0 (0.0%)
Required2 (13.3%)
Privileges Required
Low1 (6.7%)
High0 (0.0%)
None14 (93.3%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-4863HIGH Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML pag | Sep 12, 2023 | 8.8 | 96 | YES | NO |
CVE-2020-36329CRITICAL A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confi | May 21, 2021 | 9.8 | 31 | NO | NO |
CVE-2018-25014CRITICAL A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). | May 21, 2021 | 9.8 | 31 | NO | NO |
CVE-2018-25011CRITICAL A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16(). | May 21, 2021 | 9.8 | 31 | NO | NO |
CVE-2020-36328CRITICAL A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest th | May 21, 2021 | 9.8 | 30 | NO | NO |
CVE-2018-25013CRITICAL A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes(). | May 21, 2021 | 9.1 | 29 | NO | NO |
CVE-2018-25012CRITICAL A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24(). | May 21, 2021 | 9.1 | 29 | NO | NO |
CVE-2018-25009CRITICAL A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16(). | May 21, 2021 | 9.1 | 29 | NO | NO |
CVE-2020-36331CRITICAL A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentia | May 21, 2021 | 9.1 | 28 | NO | NO |
CVE-2020-36330CRITICAL A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confid | May 21, 2021 | 9.1 | 28 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
1 CVE
6.7% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Libwebp
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 0.5.1 | 1 | 7.5 | 1.4% | 0 | 0 |