CVE-2023-4863

HIGH(8.8)KEVLikely Exploited

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Description

CVE-2023-4863 is a critical heap buffer overflow vulnerability in the libwebp library used by Google Chrome and numerous other applications for processing WebP images. A remote attacker can exploit this flaw by crafting a malicious HTML page containing a specially crafted WebP image, triggering an out-of-bounds memory write that can lead to arbitrary code execution, data compromise, or application crashes. The vulnerability affects Google Chrome versions prior to 116.0.5845.187, libwebp versions before 1.3.2, and extends to Mozilla Firefox, Microsoft Edge, Microsoft Teams, and many other applications that bundle the libwebp library. With an EPSS score of 94.1% placing it in the 99.9th percentile, CVE-2023-4863 represents one of the most actively targeted vulnerabilities, and CISA has confirmed its active exploitation in the wild.

KEV Information

Vendor
Google
Product
Chromium WebP
Date Added
September 13, 2023
Due Date
October 4, 2023
Required Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9

CWEs

CWE-787Out-of-bounds Write

Out-of-bounds Write

Affected Products

VendorProductVersion
googlechrome< 116.0.5845.187
fedoraprojectfedora37; 38; 39
debiandebian linux10.0; 11.0; 12.0
mozillafirefox< 102.15.1; < 117.0.1; >= 115.1.0, < 115.2.1
mozillathunderbird< 102.15.1; >= 115.0, < 115.2.2
microsoftedge chromium< 116.0.1938.81
microsoftteams< 1.6.00.26463; < 1.6.00.26474
microsoftwebp image extension< 1.0.62681.0
webmprojectlibwebp< 1.3.2
netappactive iq unified manager-
bentleyseequent leapfrog< 2023.2
bandisofthoneyview< 5.51

Multiple CVSS Assessments

Source: [email protected](Primary)
8.8
HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
8.8
HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-787: Out-of-bounds Write

CVE-2023-4863 involves an out-of-bounds write in the libwebp image processing library, where a heap buffer overflow occurs during the decoding of specially crafted WebP images. This weakness allows an attacker to write data beyond the boundaries of allocated memory, potentially corrupting adjacent data structures, hijacking program control flow, or executing arbitrary code.

Learn more: CWE-787 — Out-of-bounds Write

Impact Analysis

CVE-2023-4863 is remotely exploitable over the network without physical access and requires low attack complexity, meaning no special conditions are needed beyond delivering a malicious WebP image to the victim. Privileges Required (None): no authentication is needed to exploit this vulnerability. User Interaction (Required): the victim must visit a malicious webpage or open a crafted document containing the exploit payload. Confidentiality (High): successful exploitation can expose sensitive data stored in browser memory or the application process, including credentials, session tokens, and personal information. Integrity (High): the out-of-bounds write allows arbitrary modification of memory contents, enabling code execution and system compromise. Availability (High): exploitation can crash the affected application or destabilize the underlying system. With a CVSS score of 8.8 (High) and an EPSS score of 94.1% indicating near-certain exploitation activity, CVE-2023-4863 poses an extreme risk to any system running an unpatched version of libwebp or applications that depend on it.

Exploit Maturity

Public exploit code is available for CVE-2023-4863 through multiple sources, including detailed technical analysis via Isosceles Security, Stack Diary, Vicarius vSociety, and Seth Larson's analysis. CISA has confirmed active exploitation in the wild by adding CVE-2023-4863 to its Known Exploited Vulnerabilities catalog, and this vulnerability was originally discovered as a zero-day being exploited in targeted attacks. The EPSS score of 94.1% places this vulnerability in the 99.9th percentile, indicating near-certain exploitation activity across the threat landscape, making immediate patching essential for all affected products.

Remediation

  1. Apply vendor patches immediately: Update Google Chrome to version 116.0.5845.187 or later, and upgrade libwebp to version 1.3.2 or later. CISA required remediation by October 4, 2023. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  2. Patch all affected applications: Because the vulnerability resides in the libwebp library, update all software that bundles it, including Mozilla Firefox, Mozilla Thunderbird, Microsoft Edge (Chromium-based), Microsoft Teams, Microsoft WebP Image Extension, and any third-party applications using libwebp such as Electron-based apps, Bentley Seequent LeapFrog, and Bandisoft Honeyview.
  3. Deploy content filtering and network controls: Implement web content filtering to block or inspect WebP images from untrusted sources. Configure web application firewalls (WAF) to detect and block malformed WebP payloads targeting the heap buffer overflow.
  4. Monitor for exploitation indicators: Review browser crash logs, process memory dumps, and endpoint detection alerts for signs of heap corruption or unexpected code execution related to image processing. Check for anomalous WebP file downloads or unusually large WebP images that may indicate exploit delivery.
  5. Conduct software inventory assessment: Identify all applications in your environment that depend on the libwebp library using software composition analysis (SCA) tools. Prioritize patching based on internet exposure and user interaction patterns, as the vulnerability requires a user to open a crafted page or document.

Technical Details

CVE-2023-4863 is a heap buffer overflow (CWE-787: Out-of-bounds Write) in the libwebp library's WebP image decoding functionality, specifically in the Huffman coding implementation used during lossless WebP decompression. The vulnerability occurs when a specially crafted WebP image triggers an out-of-bounds memory write on the heap, allowing an attacker to overwrite adjacent memory structures and potentially achieve arbitrary code execution within the context of the rendering process. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that exploitation is network-based with low complexity, requires no privileges but does need user interaction (visiting a malicious page), and achieves full impact across confidentiality, integrity, and availability. The scope is unchanged, meaning the impact is confined to the vulnerable process, but since browsers and many applications run with significant user privileges, the practical impact of code execution is severe. The fix, committed in libwebp as commit 902bc91, addresses the buffer overflow by implementing proper bounds checking during the Huffman table construction phase of WebP decoding.

Frequently Asked Questions

Is CVE-2023-4863 being actively exploited?

Yes, CVE-2023-4863 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog, and it was originally discovered as a zero-day exploit being used in targeted attacks. The EPSS score of 94.1% confirms near-certain exploitation activity, and multiple public exploit resources are available.

What products are affected by CVE-2023-4863?

CVE-2023-4863 affects a wide range of products that use the libwebp library, including Google Chrome (prior to 116.0.5845.187), libwebp (prior to 1.3.2), Mozilla Firefox, Mozilla Thunderbird, Microsoft Edge Chromium, Microsoft Teams, Microsoft WebP Image Extension, Fedora, Debian Linux, NetApp Active IQ Unified Manager, Bentley Seequent LeapFrog, and Bandisoft Honeyview.

How do I fix CVE-2023-4863?

Update Google Chrome to version 116.0.5845.187 or later, upgrade libwebp to 1.3.2 or later, and patch all other affected applications including Mozilla Firefox, Microsoft Edge, and Microsoft Teams. Conduct a software inventory to identify all applications in your environment that bundle the libwebp library.

How severe is CVE-2023-4863?

CVE-2023-4863 has a CVSS score of 8.8 (High severity) with full impact on confidentiality, integrity, and availability. The EPSS score of 94.1% places it in the 99.9th percentile of exploited vulnerabilities. Given the widespread use of libwebp across browsers and applications, this vulnerability has an exceptionally broad attack surface.

CVSS Score

8.8
HIGH(8.8)

EPSS Score

EPSS Score99.73%
EPSS Percentile100.0%

Dates

PublishedSeptember 12, 2023
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch