CVE Feed

    Dashboard / CVE / CVE-2023-4863

    CVE-2023-4863

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

    Published:Sep 11, 2023
    Last Modified:Oct 24, 2025
    EPS:Sep 12, 2023
    EPSS Score:0.93606
    CVSS Score:8.8

    CISA Notification

    Description

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

    Required Action:

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Oct 4, 2023
    1073 days ago
    Alert Date
    Sep 13, 2023
    1094 days ago

    Affected Products

    Vendor
    Bandisoft
    Product
    Honeyview
    Vendor
    Bentley
    Product
    Seequent Leapfrog
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Google
    Product
    Chrome
    Vendor
    Microsoft
    Product
    Edge Chromium
    Vendor
    Microsoft
    Product
    Teams
    Vendor
    Microsoft
    Product
    Webp Image Extension
    Vendor
    Mozilla
    Product
    Firefox
    Vendor
    Mozilla
    Product
    Thunderbird
    Vendor
    Netapp
    Product
    Active Iq Unified Manager
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Tus
    Vendor
    Webmproject
    Product
    Libwebp

    Exploits

    https://blog.isosceles.com/the-webp-0day/https://news.ycombinator.com/item?id=37478403https://sethmlarson.dev/security-developer-in-residence-weekly-report-16https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/https://blog.isosceles.com/the-webp-0day/https://news.ycombinator.com/item?id=37478403https://sethmlarson.dev/security-developer-in-residence-weekly-report-16https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863https://github.com/577Industries/aegisgraphhttps://github.com/bbaranoff/CVE-2023-4863https://github.com/caoweiquan322/NotEnoughhttps://github.com/CrackerCat/CVE-2023-4863-https://github.com/GTGalaxi/ElectronVulnerableVersionhttps://github.com/huiwen-yayaya/CVE-2023-4863https://github.com/jpsbern/CVE-2023-4863https://github.com/LiveOverflow/webp-CVE-2023-4863https://github.com/mistymntncop/CVE-2023-4863https://github.com/murphysecurity/libwebp-checkerhttps://github.com/OITApps/Find-VulnerableElectronVersionhttps://github.com/pixelotes/lab-cve-2023-4863https://github.com/sarsaeroth/CVE-2023-4863-POChttps://github.com/Shcesama/cve-2023-4863-analysishttps://github.com/talbeerysec/BAD-WEBP-CVE-2023-4863

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    References

    http://www.openwall.com/lists/oss-security/2023/09/21/4
    http://www.openwall.com/lists/oss-security/2023/09/22/1
    http://www.openwall.com/lists/oss-security/2023/09/22/3
    http://www.openwall.com/lists/oss-security/2023/09/22/4
    http://www.openwall.com/lists/oss-security/2023/09/22/5
    http://www.openwall.com/lists/oss-security/2023/09/22/6
    http://www.openwall.com/lists/oss-security/2023/09/22/7
    http://www.openwall.com/lists/oss-security/2023/09/22/8
    http://www.openwall.com/lists/oss-security/2023/09/26/1
    http://www.openwall.com/lists/oss-security/2023/09/26/7
    http://www.openwall.com/lists/oss-security/2023/09/28/1
    http://www.openwall.com/lists/oss-security/2023/09/28/2
    http://www.openwall.com/lists/oss-security/2023/09/28/4
    https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
    https://blog.isosceles.com/the-webp-0day/
    https://bugzilla.suse.com/show_bug.cgi?id=1215231
    https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
    https://crbug.com/1479274
    https://en.bandisoft.com/honeyview/history/
    https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
    https://github.com/webmproject/libwebp/releases/tag/v1.3.2
    https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
    https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
    https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
    https://lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
    https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
    https://news.ycombinator.com/item?id=37478403
    https://security-tracker.debian.org/tracker/CVE-2023-4863
    https://security.gentoo.org/glsa/202309-05
    https://security.gentoo.org/glsa/202401-10
    https://security.netapp.com/advisory/ntap-20230929-0011/
    https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
    https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
    https://www.bentley.com/advisories/be-2023-0001/
    https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
    https://www.debian.org/security/2023/dsa-5496
    https://www.debian.org/security/2023/dsa-5497
    https://www.debian.org/security/2023/dsa-5498
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
    http://www.openwall.com/lists/oss-security/2023/09/21/4
    http://www.openwall.com/lists/oss-security/2023/09/22/1
    http://www.openwall.com/lists/oss-security/2023/09/22/3
    http://www.openwall.com/lists/oss-security/2023/09/22/4
    http://www.openwall.com/lists/oss-security/2023/09/22/5
    http://www.openwall.com/lists/oss-security/2023/09/22/6
    http://www.openwall.com/lists/oss-security/2023/09/22/7
    http://www.openwall.com/lists/oss-security/2023/09/22/8
    http://www.openwall.com/lists/oss-security/2023/09/26/1
    http://www.openwall.com/lists/oss-security/2023/09/26/7
    http://www.openwall.com/lists/oss-security/2023/09/28/1
    http://www.openwall.com/lists/oss-security/2023/09/28/2
    http://www.openwall.com/lists/oss-security/2023/09/28/4
    https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
    https://blog.isosceles.com/the-webp-0day/
    https://bugzilla.suse.com/show_bug.cgi?id=1215231
    https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
    https://crbug.com/1479274
    https://en.bandisoft.com/honeyview/history/
    https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
    https://github.com/webmproject/libwebp/releases/tag/v1.3.2
    https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
    https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
    https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
    https://lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
    https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
    https://news.ycombinator.com/item?id=37478403
    https://security-tracker.debian.org/tracker/CVE-2023-4863
    https://security.gentoo.org/glsa/202309-05
    https://security.gentoo.org/glsa/202401-10
    https://security.netapp.com/advisory/ntap-20230929-0011/
    https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
    https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
    https://www.bentley.com/advisories/be-2023-0001/
    https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
    https://www.debian.org/security/2023/dsa-5496
    https://www.debian.org/security/2023/dsa-5497
    https://www.debian.org/security/2023/dsa-5498
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
    https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High