This fixes a logic error — comparing and dereferencing a hash-map iterator against the wrong container — in WebAuthn CBOR parsing. AuthenticationExtensionsClientOutputs::fromCBOR decodes the top-level CBOR map (decodedMap), finds the ‘credProps’ entry, and then tried to look up the nested ‘rk’ key by REUSING the same iterator variable: it = it->second.getMap().find(cbor::CBORValue(“rk”)), then tested if (it != decodedMap.end() && it->second.isBool()). The find() runs on the nested credProps submap and returns an iterator into THAT submap, but the code compared it against decodedMap.end() — the end of the OUTER map — and reassigned the outer iterator in the process. Comparing iterators from two different containers is undefined behavior, and when ‘rk’ is absent from credProps the submap’s find() returns the submap’s end iterator; testing it against the wrong end and then dereferencing it->second reads past/into an invalid iterator, causing an out-of-bounds read / crash.

The fix takes a stable reference to the nested map (const auto& credPropsMap = it->second.getMap()), searches it with a separate iterator (credPropsIt), and compares against credPropsMap.end() before reading credPropsIt->second.

The restored invariant is that an iterator is only compared and dereferenced against its own container. The regression test decodes {“credProps”: {}} (credProps present, no ‘rk’) and expects a valid result with credProps->rk false.

An out-of-bounds read / crash in the WebContent process when parsing attacker-supplied WebAuthn extension-output CBOR. The primitive is a mis-compared/mis-dereferenced iterator on the parsing path, which the advisory frames as a crash; it is a memory-safety bug reachable wherever WebAuthn assertion/attestation responses are processed.