Blasting Past Webp

Summary: Google Project Zero's Ian Beer analyzed BLASTPASS PKPass samples obtained in mid-November 2023 with Amnesty International Security Lab, tracing an NSO zero-click iMessage exploit that Citizen Lab linked to two CVEs fixed in Apple's iOS 16.6.1 update on September 7, 2023. The exploit writes the 32-bit value 0x270007 at 0x58 bytes past the end of a 0x3000-byte Huffman table allocation in WebP's lossless VP8L format, then parsing fails and the decoder bails out.
What's compelling: The corruption primitive is so constrained that the write lands at a fixed offset with a value the attackers likely had little choice over, yet NSO still turned it into a zero-click chain against iOS 16.6 - and crash logs show devices targeted in November 2023, two months after the patch.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-4863
Related: Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and Biz Viz Cyber Risks · Oct 27, 2026
CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 13, 2023
The security pitfalls of social media sites offering ID-based authentication Cyber Risks ·