# Security flaw in libwebp library - Update Mp3tag to v3.22a or newer

**URL:** https://community.mp3tag.de/t/security-flaw-in-libwebp-library-update-mp3tag-to-v3-22a-or-newer/62387
**Category:** Off-Topic
**Created:** [October 12, 2023, 2:23pm UTC](https://community.mp3tag.de/t/security-flaw-in-libwebp-library-update-mp3tag-to-v3-22a-or-newer/62387 "2023-10-12T14:23:21Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![LyricsLover](https://community.mp3tag.de/letter_avatar_proxy/v4/letter/l/c6cbf5/32.png) [@LyricsLover](https://community.mp3tag.de/u/LyricsLover)
#### Post date: [October 12, 2023, 2:23pm UTC](https://community.mp3tag.de/t/security-flaw-in-libwebp-library-update-mp3tag-to-v3-22a-or-newer/62387/1 "2023-10-12T14:23:21Z")

</div>

As many of you already know, the `libwebp library` has a security problem:  
[https://nvd.nist.gov/vuln/detail/CVE-2023-4863](https://nvd.nist.gov/vuln/detail/CVE-2023-4863)  
"allowing a remote attacker to perform an out of bounds memory write via a crafted HTML page."  
Or to put it more clearly:  
A manipulated WebP image could be used to execute malware code on your target system!

**If you wonder if Mp3tag is also affected** (like many others listed in the above NIST-link as Mozilla Firefox and Thunderbird, MS Edge, Google Chrome and every other software using a libwebp library older then v1.3.2) the answer is:  
**No, Mp3tag is no more affected since Mp3tag v3.22a**

 ![image](https://community.mp3tag.de/uploads/default/original/2X/0/0e36245cb572d143dda3aa71a7c569080fedfcff.png)

If you are using WEBP cover pictures, please use a Mp3tag version newer then v3.22 from here:

> [@Mp3tag Development Build Status](https://community.mp3tag.de/t/mp3tag-development-build-status/455):
>
> Date: 2023-12-22 Version: 3.23c Status: Beta Download: 32-bit [mp3tagv323csetup.exe](https://download.mp3tag.de/mp3tagv323csetup.exe) 64-bit [mp3tagv323c-x64-setup.exe](https://download.mp3tag.de/mp3tagv323c-x64-setup.exe) (additional [notes](https://community.mp3tag.de/t/notes-on-the-64-bit-version-of-mp3tag/57250)) 3.23c (2023-12-22) FIX: cover preview control at Extended Tags and Tag Sources was not square on all systems. ([#63076](https://community.mp3tag.de/t/63076)) FIX: File List was not refreshed with performed changes after an error occurred when renaming via converter Filename - Filename with a format string that did not match all selected files. ([#63159](https://community.mp3tag.de/t/63159)) FIX: focus on File List w…

The current available Mp3tag development version is v3.22 **d**

And please don't forget to check for updates for your picture viewer tool or music playing software displaying `.webp` cover pictures.

_Update 16:45_  
If you like to see a list with the yet known over 740 applications affected, please [have a look here](https://github.com/mttaggart/electron-app-tracker/blob/main/electron_apps.csv) or [here](https://medium.com/@penquestr/libwebp-the-new-log4j-3e932b35bdcb).  
The list includes some well known software names like MS Teams, Skype and others using the Electron Framework.