CVE-2023-4863
Google Chrome, Google libwebp
Published 12 Sept 2023 · updated 17 Jun 2026 · Analyzed
8.8 High · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 13 Sept 2023, with a remediation deadline of 4 Oct 2023 for US federal agencies.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
References
- www.openwall.com/lists/oss-security/2023/09/21/4 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/22/1 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/22/3 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/22/4 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/22/5 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/22/6 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/22/7 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/22/8 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/26/1 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/26/7 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/28/1 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/28/2 · Mailing List
- www.openwall.com/lists/oss-security/2023/09/28/4 · Mailing List
- adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ · Third Party Advisory
- blog.isosceles.com/the-webp-0day/ · Exploit, Third Party Advisory
- bugzilla.suse.com/show_bug.cgi?id=1215231 · Issue Tracking, Third Party Advisory
- chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html · Vendor Advisory
- crbug.com/1479274 · Issue Tracking, Vendor Advisory
- en.bandisoft.com/honeyview/history/ · Release Notes
- github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a · Patch
- github.com/webmproject/libwebp/releases/tag/v1.3.2 · Release Notes
- lists.debian.org/debian-lts-announce/2023/09/msg00015.html · Mailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2023/09/msg00016.html · Mailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2023/09/msg00017.html · Mailing List, Third Party Advisory
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ · Mailing List