GoKawiilNew Rust-based WebP decoder 'wpd' released as libwebp alternative
Developers have released wpd, an open-source WebP image decoder written in Rust with handwritten assembly for performance-critical routines. The project aims to avoid the memory-safety bugs common in C-based decoders like libwebp, while matching or exceeding its decoding speed. Source code is available on GitHub under halidecx/wpd.
GoKawiil's interpretation of the reporting above, not reported fact.
The release responds to CVE-2023-4863, a WebP decoding flaw that reportedly affected billions of devices and was confirmed by CISA as actively exploited in the wild. By writing the decoder in Rust, with assembly use scoped and an option to compile without it, the project could reduce the kind of memory-safety vulnerabilities that, according to the Chromium team, account for around 70% of their high-severity security bugs. Its real-world impact will likely depend on whether browsers, operating systems, and apps adopt it over the entrenched libwebp library.
- wpd is a new memory-safety-focused WebP decoder written primarily in Rust.
- It is designed as an alternative to libwebp, following the actively exploited CVE-2023-4863 vulnerability.
- The project claims faster single-threaded and multi-threaded performance than libwebp, alongside improved safety.
Source: halide.cx, 2026-10-03
Published there as: “Memory-Safe WebP Decoding”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.