BLASTPASS (CVE-2023-4863 & CVE-2023-41064): The libwebp Zero-Click Exploit

1. September 2023: The Universal Image Decoder Vulnerability

In September 2023, The Citizen Lab at the University of Toronto uncovered a zero-click, zero-day exploit chain actively weaponized in the wild against civil society and corporate executives dubbed BLASTPASS (CVE-2023-41064 and CVE-2023-4863). The vulnerability lived inside Google's open-source libwebp image library, which powers WebP compression across Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge, Electron applications (Slack, Discord, VS Code), and backend ecommerce image transformation microservices.

2. CVE Metadata Overview

3. Technical Root Cause: The Huffman Code Table Overflow

Lossless WebP images use canonical Huffman coding to compress image data into variable-length bit sequences. To decode these bitstreams efficiently, libwebp (in src/dec/vp8l_dec.c) pre-allocates an array of lookup tables in heap memory using the function ReadHuffmanCodeLengths().

When processing malformed Huffman code trees with specific prefix-code length distributions, the calculation responsible for determining the required lookup table capacity undercounted the number of 2nd-level table nodes. When the decoder populated the lookup table, it wrote out of bounds past the allocated heap chunk:

// In libwebp/src/dec/vp8l_dec.c
static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
                            const int code_lengths[], int code_lengths_size) {
    // Undercounted table allocation size led to heap buffer write overflow
    HuffmanCode* table = root_table;
    // ... Overflows contiguous heap allocations ...
}

By carefully grooming the heap layout with preceding image allocations, attackers corrupted memory pointers, hijacked instruction registers, and executed arbitrary shellcode without user interaction.

4. Impact on Cloud Ecommerce Stacks

Modern ecommerce platforms rely heavily on real-time image optimization proxies (Cloudinary, Imgix, thumbor, ImageMagick, libvips, and Node.js sharp modules) to dynamically convert high-resolution product photos into next-gen WebP format. Processing untrusted customer-uploaded images or vendor catalog feeds through vulnerable libwebp binaries created direct remote code execution vulnerabilities in backend media processing pods.

5. Remediation & Hardening Blueprint

# Audit installed libwebp version on Ubuntu/Debian
dpkg -l | grep libwebp

# Upgrade libwebp to 1.3.2 or higher
sudo apt update && sudo apt --only-upgrade install libwebp7 libwebpdemux2 libwebpmux3

1. Rebuild all Docker base images utilizing Alpine, Ubuntu, or Debian containing Node.js sharp, PHP GD, or ImageMagick packages.
2. Enforce memory sandboxing (gVisor / seccomp) on image processing microservices.