PT-2026-23916 · Mrnanko · Webp4J

Sp1D3R · Published 2026-03-08 · Updated 2026-03-08 · CVE-2026-3707

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MrNanko webp4j versions up to 1.3.x

Description A flaw exists in the DecodeGifFromMemory function within the src/main/c/gif decoder.c file of MrNanko webp4j. Manipulation of the canvas height argument can lead to an integer overflow. Local access is needed for exploitation. The exploit is publicly available.

Recommendations Implement the patch 89771b201c66d15d29e4cc016d8aae82b6a5fbe1 to correct this issue.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

CWE-189

Related Identifiers

CVE-2026-3707

Affected Products

Webp4J

References · 13

• 🔥 https://github.com/Sp1d3rL1/Webp4j-Heap-Buffer-Overflow/blob/main/README.EN.md · Exploit
• https://github.com/MrNanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1 · Patch
• https://osv.dev/vulnerability/CVE-2026-3707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3707 · Security Note
• https://github.com/MrNanko/webp4j/issues/6 · Note
• https://github.com/MrNanko/webp4j/issues/6#issuecomment-3941945014 · Note
• https://vuldb.com/?id.349653 · Note
• https://twitter.com/CVEnew/status/2030747882585018445 · Twitter Post
• https://vuldb.com/?ctiid.349653 · Note
• https://vuldb.com/?submit.765972 · Note
• https://twitter.com/VulmonFeeds/status/2030521641143308404 · Twitter Post
• https://github.com/MrNanko/webp4j · Note
• https://t.me/CVEtracker/46782 · Telegram Post