The WebP 0day (blog.isosceles.com)
from tedu@inks.tedunangst.com to inks@inks.tedunangst.com on 21 Sep 2023 20:29
https://inks.tedunangst.com/l/5038

This means that someone, somewhere, had been caught using an exploit for this vulnerability. But who discovered the vulnerability and how was it being used? How does the vulnerability work? Why wasn’t it discovered earlier? And what sort of impact does an exploit like this have?

There are still a lot of details that are missing, but this post attempts to explain what we know about the unusual circumstances of this bug, and provides a new technical analysis and proof-of-concept trigger for CVE-2023-4863 (“the WebP 0day“).

#compression #exploit #format #fuzzing #programming #security

#compression #exploit #format #fuzzing #inks #programming #security