CLEANSTART-2026-CU18243 webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size

CVE-2026-46601 affects multiple packages. The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. See references for individual vulnerability details...

cve-2023-5217-poc

CVE-2023-5217: libvpx VP8 인코딩 힙 오버플로우 PoC CVE-2023-5217은 야생에서 악용된 libvpx 취약점으로, Google 위협 분석 그룹Threat Analysis Group의 Clément Lecigne에 의해 Chrome을 대상으로 하는 것으로 발견되었습니다. 이 저장소는 WebCodecs 및 MediaRecorder API를 사용하여 브라우저에서 CVE-2023-5217을 트리거하는 방법을 보여줍니다. CVE-2023-5217은 제어 가능한 오버플로우 길이와 반복되는 작은 4바이트 값의...

whitelist-bypass

ホワイトリストバイパス ビデオ通話プラットフォーム（VK Call、Yandex Telemost、WB Stream）を介してインターネットトラフィックをトンネリングし、政府のホワイトリスト検閲を回避します。 セットアップ ステップバイステップのセットアップガイド（ロシア語）：docs/SETUP.md 仕組み 2つのトンネルモードが利用可能です：DC （DataChannel）とVideo （VP8データエンコーディング）。推奨セットアップは両端でヘッドレス です -...

platform_external_libvpx_v1.4.0_CVE-2023-5217

README - 2015년 3월 23일 WebM VP8/VP9 코덱 SDK에 오신 것을 환영합니다! 애플리케이션/라이브러리 컴파일: 사용된 빌드 시스템은 autotools와 유사합니다. 일반적으로 빌드는 원하는 빌드 옵션으로 "구성한 후" GNU make를 사용하여 애플리케이션을 빌드하는 것으로 구성됩니다. 1. 전제 조건 모든 x86 대상에는 Yasm1 어셈블러가 설치되어 있어야 합니다. 모든 Windows 빌드에는 Cygwin2이 설치되어 있어야 합니다. 문서를 빌드하려면 Doxygen3이 필요합니다. 이 패키지가 없으면...

platform_external_libvpx_v1.8.0_CVE-2023-5217

README - 2019年1月31日 WebM VP8/VP9 コーデック SDK へようこそ！ アプリケーション/ライブラリのコンパイル: 使用するビルドシステムは autotools に似ています。通常、ビルドは希望するビルドオプションで「設定」し、GNU make を使用してアプリケーションをビルドします。 1. 前提条件 すべての x86 ターゲットには Yasm1 アセンブラがインストールされている必要があります2。 すべての Windows ビルドには Cygwin3 がインストールされている必要があります。 ドキュメントのビルドには Doxygen4...

Rocky Linux 8 [CIQ] Security Update: libvpx-debuginfo / libvpx-debugsource Multiple Vulnerabilities (crlsa-2023_5537)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235537 advisory. libvpx: Heap buffer overflow in vp8 encoding in libvpx CVE-2023-5217 libvpx: crash related to VP9 encoding in libvpx CVE-2023-44488 Tenable has extracted t...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Chromium, and LibVpx

A heap buffer overflow occurred in the vp8 encoding process in libvpx within Google Chrome before version 117.0.5938.132. In version 1.13.1 of libvpx, a remote attacker could potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvpx (UTSA-2023-003033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003033 advisory. Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap...

Important: rclone

Issue Overview: The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. CVE-2026-46601 The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-46601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. CVE-2026-46601 Note that Nessus relies on the presence...

CVE-2026-46601

A flaw was found in the golang.org/x/image/webp library's WebP decoder. A remote attacker could exploit this vulnerability by providing a specially crafted WebP image containing a VP8 chunk with mismatched dimensions. This could cause the decoder to panic, leading to a denial of service DoS for...

Uncaught Exception

Overview golang.org/x/image/webp is a Package webp implements a decoder for WEBP images. Affected versions of this package are vulnerable to Uncaught Exception in the webp decoder when processing a VP8 chunk with dimensions that do not match the canvas size. An attacker can cause a denial of...

CVE-2026-46601 Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

CVE-2026-46601

The webp decoder is vulnerable to a panic condition when processing a VP8 chunk where the dimensions do not match the canvas size. This vulnerability impacts multiple packages including mailpit (fixed in version 1.29.7-r1), ollama (fixed in versions 0.23.4-r2, 0.30.10-r0, 0.31.2-r2, 0.32.11-r3), ...

CVE-2026-46601

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

CVE-2026-46601: Undefined Security Weakness

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

GO-2026-5061 Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

OSV-2026-889 Use-of-uninitialized-value in vp8_compute_skin_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520701729 Crash type: Use-of-uninitialized-value Crash state: vp8computeskinblock encodeframetodatarate vp8getcompresseddata...

OSV-2026-868 Use-of-uninitialized-value in vp8_regular_quantize_b_sse4_1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520318421 Crash type: Use-of-uninitialized-value Crash state: vp8regularquantizebsse41 macroblockyrd vp8rdpickintramode...

PT-2026-50183

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520318421 Crash type: Use-of-uninitialized-value Crash state: vp8 regular quantize b sse4 1 macro block yrd vp8 rd pick intra mode...