CVE-2023-4863

HIGHCISA KEV

8.8

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published9/12/2023

Last Modified10/24/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorGoogle

ProductChromium WebP

Vulnerability NameGoogle Chromium WebP Heap-Based Buffer Overflow Vulnerability

KEV Date Added2023-09-13

Remediation Due Date2023-10-04

Ransomware UseUnknown

Affected Products

bandisoft:honeyviewbentley:seequent_leapfrogdebian:debian_linuxfedoraproject:fedoragoogle:chromemicrosoft:edge_chromiummicrosoft:teamsmicrosoft:webp_image_extensionmozilla:firefoxmozilla:thunderbirdnetapp:active_iq_unified_managerwebmproject:libwebp

Weaknesses (CWE)

CWE-787CWE-787

References

http://www.openwall.com/lists/oss-security/2023/09/21/4(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/22/1(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/22/3(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/22/4(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/22/5(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/22/6(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/22/7(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/22/8(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/26/1(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/26/7(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/28/1(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/28/2(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/28/4(chrome-cve-admin@google.com)

https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/(chrome-cve-admin@google.com)

https://blog.isosceles.com/the-webp-0day/(chrome-cve-admin@google.com)

https://bugzilla.suse.com/show_bug.cgi?id=1215231(chrome-cve-admin@google.com)

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html(chrome-cve-admin@google.com)

https://crbug.com/1479274(chrome-cve-admin@google.com)

https://en.bandisoft.com/honeyview/history/(chrome-cve-admin@google.com)

https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a(chrome-cve-admin@google.com)

https://github.com/webmproject/libwebp/releases/tag/v1.3.2(chrome-cve-admin@google.com)

https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html(chrome-cve-admin@google.com)

https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html(chrome-cve-admin@google.com)

https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/(chrome-cve-admin@google.com)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863(chrome-cve-admin@google.com)

https://news.ycombinator.com/item?id=37478403(chrome-cve-admin@google.com)

https://security-tracker.debian.org/tracker/CVE-2023-4863(chrome-cve-admin@google.com)

https://security.gentoo.org/glsa/202309-05(chrome-cve-admin@google.com)

https://security.gentoo.org/glsa/202401-10(chrome-cve-admin@google.com)

https://security.netapp.com/advisory/ntap-20230929-0011/(chrome-cve-admin@google.com)

https://sethmlarson.dev/security-developer-in-residence-weekly-report-16(chrome-cve-admin@google.com)

https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/(chrome-cve-admin@google.com)

https://www.bentley.com/advisories/be-2023-0001/(chrome-cve-admin@google.com)

https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/(chrome-cve-admin@google.com)

https://www.debian.org/security/2023/dsa-5496(chrome-cve-admin@google.com)

https://www.debian.org/security/2023/dsa-5497(chrome-cve-admin@google.com)

https://www.debian.org/security/2023/dsa-5498(chrome-cve-admin@google.com)

https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/21/4(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/22/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/22/3(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/22/4(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/22/5(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/22/6(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/22/7(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/22/8(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/26/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/26/7(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/28/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/28/2(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/28/4(af854a3a-2127-422b-91ae-364da2661108)

https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/(af854a3a-2127-422b-91ae-364da2661108)

https://blog.isosceles.com/the-webp-0day/(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.suse.com/show_bug.cgi?id=1215231(af854a3a-2127-422b-91ae-364da2661108)

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html(af854a3a-2127-422b-91ae-364da2661108)

https://crbug.com/1479274(af854a3a-2127-422b-91ae-364da2661108)

https://en.bandisoft.com/honeyview/history/(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/webmproject/libwebp/releases/tag/v1.3.2(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/(af854a3a-2127-422b-91ae-364da2661108)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863(af854a3a-2127-422b-91ae-364da2661108)

https://news.ycombinator.com/item?id=37478403(af854a3a-2127-422b-91ae-364da2661108)

https://security-tracker.debian.org/tracker/CVE-2023-4863(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202309-05(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202401-10(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20230929-0011/(af854a3a-2127-422b-91ae-364da2661108)

https://sethmlarson.dev/security-developer-in-residence-weekly-report-16(af854a3a-2127-422b-91ae-364da2661108)

https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/(af854a3a-2127-422b-91ae-364da2661108)

https://www.bentley.com/advisories/be-2023-0001/(af854a3a-2127-422b-91ae-364da2661108)

https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5496(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5497(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5498(af854a3a-2127-422b-91ae-364da2661108)

https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/(af854a3a-2127-422b-91ae-364da2661108)

https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.