CVE-2023-5129 — webp
CVE-2023-5129 is a remote code execution vulnerability in platform/external/webp. 1 public exploit reference exists, so weaponization risk is real. A fix is available for platform/external/webp — see the affected versions and patch details below.
Real-World Exposure
platform/external/webp📦platform/external/webp📦platform/external/webp📦platform/external/webp📦platform/external/webpReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Android packages — download data is not available via public APIs for these ecosystems.
Description
In BuildHuffmanTable of huffman_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦Android | platform/external/webp | ≥ 14-next:0&&< 14-next:2023-10-06 | 14-next:2023-10-06 |
| 📦Android | platform/external/webp | ≥ 11:0&&< 11:2023-10-06 | 11:2023-10-06 |
| 📦Android | platform/external/webp | ≥ 12:0&&< 12:2023-10-06 | 12:2023-10-06 |
| 📦Android | platform/external/webp | ≥ 12L:0&&< 12L:2023-10-06 | 12L:2023-10-06 |
| 📦Android | platform/external/webp | ≥ 13:0&&< 13:2023-10-06 | 13:2023-10-06 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for platform/external/webp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update platform/external/webp to 14-next:2023-10-06 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-5129 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This flaw was found to be a duplicate of CVE-2023-4863. Please see https://access.redhat.com/security/cve/CVE-2023-4863 for information about affected products and security errata.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 7 | thunderbird-0:102.15.1-1.el7_9 | RHSA-2023:5191 |
| Red Hat Enterprise Linux 7 | firefox-0:102.15.1-1.el7_9 | RHSA-2023:5197 |
| Red Hat Enterprise Linux 8 | firefox-0:102.15.1-1.el8_8 | RHSA-2023:5184 |
| Red Hat Enterprise Linux 8 | thunderbird-0:102.15.1-1.el8_8 | RHSA-2023:5201 |
| Red Hat Enterprise Linux 8 | libwebp-0:1.0.0-8.el8_8.1 | RHSA-2023:5309 |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | firefox-0:102.15.1-1.el8_1 | RHSA-2023:5183 |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | thunderbird-0:102.15.1-1.el8_1 | RHSA-2023:5188 |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | libwebp-0:1.0.0-5.2.el8_1.1 | RHSA-2023:5236 |
Frequently Asked Questions
Is CVE-2023-5129 in your dependencies?
Find it across Android, including transitive dependencies.