{"id":"CVE-2023-4863","kind":"vulnerability","aliases":["CVE-2023-4863"],"related":[],"title":"Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker…","description":"Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"A heap-based buffer overflow in the WebP image decoder used by Google Chromium lets a remote attacker write out of bounds in memory using a crafted HTML page. Applications that use the WebP codec are also affected, and CISA reports it is being exploited in the wild.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-09-13T00:00:00+00:00","products":[{"name":"Google Chromium WebP","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google chrome","fixed":["116.0.5845.187"],"affected":"< 116.0.5845.187","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 37","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["102.15.1"],"affected":"< 102.15.1","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["117.0.1"],"affected":"< 117.0.1","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["115.2.1"],"affected":">= 115.1.0, < 115.2.1","ecosystem":"vendor"},{"name":"mozilla thunderbird","fixed":["102.15.1"],"affected":"< 102.15.1","ecosystem":"vendor"},{"name":"mozilla thunderbird","fixed":["115.2.2"],"affected":">= 115.0, < 115.2.2","ecosystem":"vendor"},{"name":"microsoft edge chromium","fixed":["116.0.1938.81"],"affected":"< 116.0.1938.81","ecosystem":"vendor"},{"name":"microsoft teams","fixed":["1.6.00.26463"],"affected":"< 1.6.00.26463","ecosystem":"vendor"},{"name":"microsoft teams","fixed":["1.6.00.26474"],"affected":"< 1.6.00.26474","ecosystem":"vendor"},{"name":"microsoft webp image extension","fixed":["1.0.62681.0"],"affected":"< 1.0.62681.0","ecosystem":"vendor"},{"name":"webmproject libwebp","fixed":["1.3.2"],"affected":"< 1.3.2","ecosystem":"vendor"},{"name":"netapp active iq unified manager","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"bentley seequent leapfrog","fixed":["2023.2"],"affected":"< 2023.2","ecosystem":"vendor"},{"name":"bandisoft honeyview","fixed":["5.51"],"affected":"< 5.51","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chrome","chromium","electron","exploited","runtime","webp"],"not_affected_if":["unpatched-libwebp-absent"],"how_to_check":null,"fix":"Apply the vendor mitigation or update Chromium-based browsers and WebP-linked applications to a patched release; CISA says to discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2023-09-12T15:15:24+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:40+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:04:40Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or update Chromium-based browsers and WebP-linked applications to a patched release; CISA says to discontinue use of the product if mitigations are unavailable.","reach":"internet","impact":"high","summary":"A heap-based buffer overflow in the WebP image decoder used by Google Chromium lets a remote attacker write out of bounds in memory using a crafted HTML page. Applications that use the WebP codec are also affected, and CISA reports it is being exploited in the wild.","category":"runtime","who_cares":["chromium","chrome","webp","electron","browsers"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code via crafted webpage, compromising the browser or host process","analyst_note":"Sources do not list fixed versions or detection steps; check the Chrome Releases blog and the CVE-2023-4863 NVD/vendor advisories for patched versions and affected library builds.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unpatched-libwebp-absent"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000488,"input_tokens":2849,"output_tokens":406,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':20A,23A '-4863':21A,24A '1.3.2':14A '116.0.5845.187':11A 'action':173C 'active':66A 'affect':120B,164C 'allow':15A,143C 'also':119B 'appli':174C 'applic':112B,165C 'attack':18A,100B,146C 'bandisoft':73A 'base':85B,138C 'bentley':70A 'bound':104B,153C 'browser':75B 'buffer':2A,86B,139C 'chrome':8A,29A,76B 'chromium':26A,54A,77B,96B,132C 'cisa':122B,171C 'codec':117B,170C 'contain':134C 'craft':109B,158C 'cve':19A,22A 'debian':36A,38A,40A 'decod':92B 'discontinu':180C 'edge':53A 'electron':78B 'exploit':79B,127B 'extension':62A 'fedora':31A,33A,35A 'fedoraproject':30A,32A,34A 'firefox':43A,45A,47A 'googl':7A,95B,131C 'google':25A,28A 'heap':1A,84B,137C 'heap-bas':83B,136C 'honeyview':74A 'html':110B,159C 'imag':91B 'image':61A 'instruct':178C 'iq':67A 'leapfrog':72A 'let':97B 'libwebp':5A,13A,64A 'linux':37A,39A,41A 'manager':69A 'memori':106B,154C 'microsoft':52A,55A,57A,59A 'mitig':175C,186C 'mozilla':42A,44A,46A,48A,50A 'netapp':65A 'out-of-bound':150C 'overflow':3A,87B,140C 'page':111B,160C 'per':176C 'perform':148C 'prior':9A 'product':184C 'remot':17A,99B,145C 'report':123B 'requir':172C 'runtim':80B 'seequent':71A 'teams':56A,58A 'thunderbird':49A,51A 'unavail':188C 'unified':68A 'use':93B,107B,114B,167C,181C 'vendor':177C 'via':156C 'vulner':141C,162C 'webmproject':63A 'webp':27A,60A,81B,90B,116B,133C,169C 'wild':130B 'write':101B,155C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-09-12T15:15:24+00:00","kev":{"dateAdded":"2023-09-13","dueDate":"2023-10-04","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-4863","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4863","severity":null,"published_at":"2023-09-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-4863","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","severity":null,"published_at":"2023-09-12T15:15:24+00:00","modified_at":"2026-06-17T06:38:46+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}