CVE-2020-36328: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2020-36328) was discovered in libwebp versions before 1.0.1. The vulnerability exists in the WebPDecodeRGBInto function due to an invalid check for buffer size. This vulnerability was disclosed in May 2021 and affects various systems and applications that use the libwebp library for processing WebP image formats (NVD, Red Hat).

The vulnerability is classified with a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from an invalid buffer size check in the WebPDecodeRGBInto function, which could lead to heap-based buffer overflow conditions. The vulnerability affects the core functionality of the libwebp library used for image processing (NetApp Advisory).

The vulnerability poses significant risks to affected systems, with the highest threats being to data confidentiality, integrity, and system availability. Successful exploitation could lead to disclosure of sensitive information, modification of data, or denial of service (DoS). The critical CVSS score indicates the potential for complete compromise of affected systems (Debian Advisory, NetApp Advisory).

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. The critical CVSS score and vector string indicate that the vulnerability is highly exploitable. However, there are no public reports of active exploitation in the wild (NVD).

The vulnerability has been fixed in libwebp version 1.0.1 and later. Various vendors have released security updates to address this issue, including Red Hat, Debian, and Apple. Users are strongly recommended to upgrade their libwebp packages to the latest version (Red Hat, Debian Advisory, Apple).