Uncovering the Hidden WebP vulnerability: a tale of a CVE with much bigger implications than it originally seemed

This post details Cloudflare's discovery and rapid response to the WebP vulnerability (CVE-2023-4863), which stemmed from a heap buffer overflow in the libwebp library. Cloudflare identified the vulnerability's root cause in libwebp, distinct from its initial description as a Chrome-specific issue. They utilized an unreleased patch for libwebp to update their own services, which are written in Rust. Patches were submitted to Rust packages containing libwebp, and RustSec advisories (RUSTSEC-2023-0061 and RUSTSEC-2023-0062) were filed, informing the broader Rust ecosystem. The post highlights the interconnectedness of the internet ecosystem and the importance of swift, collaborative security responses.