[BUG] webp and CVE-2023-4863

[Jigsy1]

Code of conduct

• I have read and agree to adhere to the Code of Conduct

Self-training on how to write a bug report

• I have learned how to write a bug report

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Although I can't personally use any newer versions of Session since I'm on Windows 8.1, isn't every single version of Session now going to be impacted by that webp exploit (CVE-2023-4863) that's been reported and fixed in certain applications over the last few days?

Especially as the webp library is also part of Electron, Signal (which they've fixed), and other things...

Personally I think this needs to be clarified.

Expected Behavior

N/A

Steps To Reproduce

Unknown

Desktop Version

I was using the last version that worked with Windows 8.1 (since Uninstalled)

Anything else?

No response

[Bilb]

Hey,
thanks for the report. I made a PR with a fix.
I suspect we are impacted as Signal, and Signal did not say how they are impacted yet.