A note on CVE-2023-4863: we have not been able to confirm the impact to Flutter (and thus Cwtch UI) of the announced vulnerability in libwebp (if any).
In Cwtch, images are only ever displayed if the contact has been explicitly accepted AND the file sharing and image previews experiments are enabled.
We continue to recommend that people only enable experimental features where they understand the risks involved and also suggest enabling the Block Unknown Contacts feature in such cases.