CVE-2025-52456: 
NixOS vulnerability analysis and mitigation

CVE-2025-52456 is a memory corruption vulnerability in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When processing a specially crafted animated .webp file, an integer overflow occurs during stride calculation, leading to a heap-based buffer overflow that can result in remote code execution. The vulnerability was discovered by Cisco Talos, with initial vendor contact on 2025-07-29, a patch released on 2025-08-03, and public disclosure on 2025-08-25. It carries a CVSS v3.1 base score of 8.8 (High) (Talos Advisory).

The root cause is classified as CWE-680 (Integer Overflow to Buffer Overflow). In sail_codec_load_init_v8_webp, the library reads image dimensions (width and height) from the WebP demuxer and sets the pixel format to 32-bit RGBA, then calculates the bytes-per-line (stride). Later, in sail_codec_load_seek_next_frame_v8_webp, the stride is multiplied by the image height to determine allocation size — on 32-bit platforms, if width × height × 4 exceeds 32 bits, this multiplication overflows, producing an undersized heap buffer. The webp_private_fill_color function then iterates over the full image dimensions writing background color via memcpy, writing beyond the allocated buffer bounds. Exploitation requires the VP8X chunk's animation flag (bit 7) to be set, and the product of (WidthMinus1+1) × (HeightMinus1+1) must not itself exceed 32 bits (to bypass libwebp's internal guard), but × 4 must overflow. A Python-based proof-of-concept to generate a triggering .webp file was published alongside the advisory (Talos Advisory).

Successful exploitation allows an attacker to achieve remote code execution under the security context of the process using the SAIL library, with high impact to confidentiality, integrity, and availability. An attacker can gain unauthorized access to system resources, potentially leading to complete system compromise, data exfiltration, or installation of malware. Because SAIL is a cross-platform library (Windows, macOS, Linux) used by applications to decode images, any application embedding it and processing untrusted .webp files is at risk (Talos Advisory).

A proof-of-concept exploit (Python script to generate a malicious .webp file) was published by Cisco Talos alongside the public disclosure on 2025-08-25. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.00128, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. User interaction is required — an attacker must convince a user or application to open the crafted .webp file (Talos Advisory, Feedly).

1. Craft a malicious WebP file: Using the Talos-provided Python PoC (poc.py3.zip), generate a specially crafted animated .webp file. The VP8X chunk must have the animation flag (bit 7) set, and the WidthMinus1 and HeightMinus1 fields must be set such that (width × height) fits in 32 bits but (width × height × 4) overflows (e.g., WidthMinus1 = 0x3FFF → width = 16384, HeightMinus1 = 0xFFFF → height = 65536).
2. Deliver the file to the target: Convince a user or automated pipeline using the SAIL library to open the crafted .webp file — via email attachment, web upload, shared storage, or any other file delivery mechanism.
3. Trigger integer overflow: When the SAIL library processes the file, sail_codec_load_seek_next_frame_v8_webp computes image_size = bytes_per_line × height, which overflows on 32-bit platforms, yielding a small value.
4. Trigger heap buffer overflow: sail_malloc allocates an undersized buffer. webp_private_fill_color then iterates over the full image dimensions, writing the ANIM chunk's BackgroundColor value via memcpy far beyond the allocated buffer.
5. Achieve code execution: The heap corruption can be leveraged to overwrite adjacent heap metadata or function pointers, enabling arbitrary code execution in the context of the vulnerable process (Talos Advisory).

• File System: Presence of unusually large or malformed .webp files (particularly animated WebP with extreme canvas dimensions) in upload directories, temp folders, or image processing queues.
• Process: Crashes or abnormal termination of applications using the SAIL library when processing .webp files; AddressSanitizer reports of heap-buffer-overflow in webp_private_fill_color (helpers.c:39) or sail_codec_load_seek_next_frame_v8_webp (webp.c:206-210).
• Logs: Application crash logs referencing WEBP codec processing failures; core dumps from processes invoking sail_load_next_frame or sail_codec_load_seek_next_frame_v8_webp.
• Network: Unexpected outbound connections from image-processing services following .webp file ingestion, which may indicate post-exploitation activity (Talos Advisory).

The vendor released a patch on 2025-08-03; users should update the SAIL Image Decoding Library beyond v0.9.8 (including commit 221db576ce1263ab92bd882f344b68b8eec16cad on master). As interim workarounds: restrict or disable processing of .webp files from untrusted sources, implement strict input validation and file size/dimension checks before passing images to SAIL, and sandbox image-processing components to limit the blast radius of exploitation. Monitoring and restricting .webp file uploads in web applications is also recommended (Talos Advisory).

Cisco Talos published a detailed technical advisory (TALOS-2025-2224) covering the full vulnerability mechanics, crash information, and a proof-of-concept on the public disclosure date. The Talos blog post covering this and related vulnerabilities (libbiosig, Tenda, PDF-XChange, Foxit) was picked up by Malware News and security aggregators. RedPacket Security noted the CVE on Mastodon. No significant broader media coverage or notable researcher commentary beyond Talos has been identified (Talos Blog, Talos Advisory).