CVEvulnerability

CVE-2023-4863

8.8 HIGH Known exploited Published 2023-09-12 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability — Google Chromium WebP

Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

Added to KEV
2023-09-13
Remediation due
2023-10-04
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1; https://nvd.nist.gov/vuln/detail/CVE-2023-4863
Status
Analyzed
Published
2023-09-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-787

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Affected configurations

• google chrome (< 116.0.5845.187) • fedoraproject fedora 37 • fedoraproject fedora 38 • fedoraproject fedora 39 • debian debian linux 10.0 • debian debian linux 11.0 • debian debian linux 12.0 • mozilla firefox (< 102.15.1) • mozilla firefox (< 117.0.1) • mozilla firefox (>= 115.1.0 < 115.2.1) • mozilla thunderbird (< 102.15.1) • mozilla thunderbird (>= 115.0 < 115.2.2) • microsoft edge chromium (< 116.0.1938.81) • microsoft teams (< 1.6.00.26463) • microsoft teams (< 1.6.00.26474) • microsoft webp image extension (< 1.0.62681.0) • webmproject libwebp (< 1.3.2) • netapp active iq unified manager • bentley seequent leapfrog (< 2023.2) • bandisoft honeyview (< 5.51)

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References