CVE-2020-36329: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2020-36329) was discovered in libwebp versions before 1.0.1. The vulnerability occurs due to a thread being killed too early in the EmitFancyRGB() function in dec/io_dec.c (Red Hat Bugzilla). This vulnerability was reported in May 2021 and affects multiple systems and applications that use the libwebp library (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a critical severity level. The issue stems from a use-after-free condition in the EmitFancyRGB() function where a thread is terminated prematurely, potentially leading to memory corruption (NetApp Advisory).

The vulnerability poses significant risks to data confidentiality, integrity, and system availability. When successfully exploited, it could lead to disclosure of sensitive information, modification of data, or cause a denial of service (DoS) condition (Debian Security).

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. While specific exploit code is not publicly referenced, the vulnerability has been acknowledged and patched by multiple vendors, indicating its potential for exploitation (NetApp Advisory).

The vulnerability has been fixed in libwebp version 1.0.1 and later. Multiple vendors have released security updates to address this issue, including Debian (version 0.6.1-2+deb10u1), Red Hat Enterprise Linux, and Apple iOS/iPadOS 14.7. Users are strongly recommended to upgrade to the patched versions (Apple Security, Debian Advisory).