Critical Vulnerability in LibWebP Exploited in the Wild
Vulnerability discovered in libwebp library which parses WebP image format. The libwebp vulnerability fix requires a runtime SBOM tool.
The vulnerability discovered in the libwebp library extends beyond browsers such as Chrome, Edge and Chromium-based applications because libwebp is in widespread use by numerous operating systems and popular application frameworks that render .webp images.
As a result, the libwebp vulnerability impacts general-purpose software like Pillow and FFMPEG.
It's important to note that some of these applications and software components can be bundled as dependencies to containers and possibly direct or in-direct dependencies to your software.
Reported CVEs
CVE-2023-4863 CVSS: 8.8: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVE-2023-41064 CVSS: 7.8: Buffer overflow vulnerability in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution.
CVE-2023-41061 CVSS: 7.8: This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Note that CVE-2023-5129, submitted by Google Chrome and initially ranked with the maximum vulnerability score of 10, was later rejected due to duplication.
How can I tell if I am Affected?
Libwebp from 0.5.0 up to and including 1.3.1 are affected. You must ensure that you have version 1.3.2 or newer to remediate the vulnerability.
To know whether you’re affected you need to understand all the building blocks of your software. A Software Bill of Materials (SBOM) is a comprehensive inventory, a detailed list of ingredients that make up software components, including the usage and version of libwebp. Because SBOM contains every building block of the software, it means that it contains much more than the direct dependencies of your software. Before you rush into fixing the vulnerability, first, ensure it is executed. If the vulnerable library exists but isn't running, it doesn't pose a security gap.
Runtime SBOM required to fix libwebp
Determining if libwebp is running in your environment requires a runtime SBOM tool which can detect which code is active. It can identify if the vulnerable library was loaded into memory, if the vulnerable function [.code-span]ReadHuffmanCodes[.code-span] was loaded into memory, and if that function was executed. One of the main goals of runtime SBOM is to reduce false positives and alerts, enabling you to focus on fixing only the most relevant vulnerabilities.
Using Kodem you can detect all your dependencies and know which service uses a vulnerable libwebp and whether it is loaded into memory and executed.
After detecting the vulnerable packages, we face the important question of how they should be fixed? Using Kodem’s runtime application context we can not only understand that we have a vulnerable package but also determine which resource is using it, and which command downloaded the library as part of the Docker build.
Kodem's Runtime-powered Application Security Platform Can Help
The Kodem platform is differentiated in the crowded landscape of application security because of its focus on runtime AI and streamlining remediation. Let us help you scan your infrastructure today to discover if you’re really affected by Libwebp vulnerabilities.
Related blogs
Prompt Injection was Never the Real Problem
A review of “The Promptware Kill Chain”Over the last two years, “prompt injection” has become the SQL injection of the LLM era: widely referenced, poorly defined, and often blamed for failures that have little to do with prompts themselves.A recent arXiv paper, “The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multi-Step Malware,” tries to correct that by reframing prompt injection as just the initial access phase of a broader, multi-stage attack chain.As a security researcher working on real production AppSec and AI systems, I think this paper is directionally right and operationally incomplete.This post is a technical critique: what the paper gets right, where the analogy breaks down, and how defenders should actually think about agentic system compromise.
CVE-2026-21858: Ni8mare: Unauthenticated Remote Code Execution in n8n
An unauthenticated Remote Code Execution (RCE) flaw, tracked as CVE-2026-21858 (CVSS 10.0), has been discovered in n8n, the widely-adopted workflow automation platform. With over 100 million Docker pulls and an estimated 100,000 locally deployed instances, this vulnerability transforms n8n from a productivity tool into a severe single point of potential failure for organizations globally.
Guess Who's Back: Shai-Hulud 3.0 The Golden Path
Security analysts recently identified a new variant of the Shai-Hulud npm supply chain worm in the public registry, signaling continued evolution of this threat family. This variant, dubbed “The Golden Path” exhibits modifications from prior waves of the malware, suggesting ongoing evolution in the threat actor’s tradecraft.
A Primer on Runtime Intelligence
See how Kodem's cutting-edge sensor technology revolutionizes application monitoring at the kernel level.
Platform Overview Video
Watch our short platform overview video to see how Kodem discovers real security risks in your code at runtime.
The State of the Application Security Workflow
This report aims to equip readers with actionable insights that can help future-proof their security programs. Kodem, the publisher of this report, purpose built a platform that bridges these gaps by unifying shift-left strategies with runtime monitoring and protection.
.png)
Get real-time insights across the full stack…code, containers, OS, and memory
Watch how Kodem’s runtime security platform detects and blocks attacks before they cause damage. No guesswork. Just precise, automated protection.
Stay up-to-date on Audit Nexus
A curated resource for the many updates to cybersecurity and AI risk regulations, frameworks, and standards.