PT-2026-23916 · Mrnanko · Webp4J

Sp1D3R · Publicado 2026-03-08 · Atualizado 2026-03-08 · CVE-2026-3707

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MrNanko webp4j versions up to 1.3.x

Description A flaw exists in the DecodeGifFromMemory function within the src/main/c/gif decoder.c file of MrNanko webp4j. Manipulation of the canvas height argument can lead to an integer overflow. Local access is needed for exploitation. The exploit is publicly available.

Recommendations Implement the patch 89771b201c66d15d29e4cc016d8aae82b6a5fbe1 to correct this issue.

Exploit

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

CWE-189

Identificadores relacionados

CVE-2026-3707

Produtos afetados

Webp4J

Referências · 13

• 🔥 https://github.com/Sp1d3rL1/Webp4j-Heap-Buffer-Overflow/blob/main/README.EN.md · Exploit
• https://github.com/MrNanko/webp4j/issues/6 · Nota
• https://github.com/MrNanko/webp4j/issues/6#issuecomment-3941945014 · Nota
• https://github.com/MrNanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1 · Correção
• https://vuldb.com/?id.349653 · Nota
• https://osv.dev/vulnerability/CVE-2026-3707 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2030747882585018445 · Publicação no Twitter
• https://vuldb.com/?ctiid.349653 · Nota
• https://vuldb.com/?submit.765972 · Nota
• https://twitter.com/VulmonFeeds/status/2030521641143308404 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3707 · Nota de Segurança
• https://github.com/MrNanko/webp4j · Nota
• https://t.me/CVEtracker/46782 · Publicação no Telegram