UPDATE: Images are ok. Images are rendered via a rust library that does not have this vulnerability. It is videos that could be suspect.

If your build of gossip does not include the 'video-ffmpeg' feature, then it doesn't use the libwebp library. You can check by running 'ldd' on the binary. Here is ldd run against a gossip binary that has not enabled that feature:

myr gossip] ldd target/debug/gossip

linux-vdso.so.1 (0x00007ffefcd15000)

libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x00007f7e98ddb000)

libm.so.6 => /usr/lib/libm.so.6 (0x00007f7e98cee000)

libc.so.6 => /usr/lib/libc.so.6 (0x00007f7e93200000)

/lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007f7e98e39000)

If instead you see something like this:

libwebp.so.7 => /usr/lib/libwebp.so.7 (0x00007efefa52c000)

then your client may be vulnerable.

I could use help understanding this vulnerability.