“This bug also shows that we have an over-reliance on fuzzing for security assurance of complex parser code.”
CVE-2023-4863 is a heap overflow in libwebp’s Huffman table code, and it was almost certainly the image bug NSO used in the BLASTPASS iMessage attack. OSS-Fuzz had been hammering lossless WebP for years and never found it. Google wrote a new fuzzer for the Huffman routines after the fix, and that one doesn’t find it either. One C library that every browser and app ships means one bug pays out across all of them, and the spyware vendors read the code more carefully than the people who maintain it.