It’s last week’s big libwebp vulnerability again.

Edit: this underlying vuln is why last week’s CVE was such a big deal, anything using webp is at risk including a whole big pile of electron apps that everyone uses.

Sorta. OP just linked the full disclosure of the libwebp vulnerability that made the news 2 weeks ago.

But there’s an even more recent vulnerability in libvpx that was announced this week, that is similar in a lot of ways (including severity).