CVE-2023-4863
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 2 November 2026
- CWE
- CWE-787
Affected products
google: chrome; fedoraproject: fedora; debian: debian linux; mozilla: firefox; mozilla: thunderbird; microsoft: edge chromium; microsoft: teams; microsoft: webp image extension; webmproject: libwebp; netapp: active iq unified manager; bentley: seequent leapfrog; bandisoft: honeyview
References
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop… Vendor Advisory
- https://crbug.com/1479274 Issue TrackingVendor Advisory
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop… Vendor Advisory
- https://crbug.com/1479274 Issue TrackingVendor Advisory
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2a… Patch
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 PatchThird Party Advisory
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2a… Patch
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 PatchThird Party Advisory
- https://blog.isosceles.com/the-webp-0day/ ExploitThird Party Advisory
- https://news.ycombinator.com/item?id=37478403 ExploitThird Party Advisory