The vulnerability lies in the DecodeGifFromMemory function of the webp4j library. Manipulating the canvas_height argument can trigger an integer overflow. The overflow could lead to memory corruption, which is inferred from the nature of integer overflow vulnerabilities and not explicitly detailed in the CVE text.

MrNanko webp4j versions up to 1.3.x are affected. The flaw exists in the gif_decoder.c source file used when the library decodes GIF images in applications that embed webp4j. Any system that incorporates these versions without the recent patch is potentially vulnerable.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not cataloged in the CISA KEV. Exploitation requires local access; an attacker must supply a crafted GIF file to the vulnerable application. Because a public exploit is available, systems running the affected library should apply the patch urgently to prevent possible memory corruption.