CVE-2023-4863
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
Published Sep 12, 2023 · updated Jun 16, 2026 · google chrome
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Timeline
Detection, updates, and resolution for this record.
Sep 12, 2023 · Catalog
Detected
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Sep 13, 2023 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Oct 4, 2023 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Oct 4, 2023
Affected
- cpe bentley/seequent leapfrogversion unspecified
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe debian/debian linux12.0
- cpe fedoraproject/fedora37
- cpe fedoraproject/fedora38
- cpe fedoraproject/fedora39
- cpe google/chromeversion unspecified
- cpe microsoft/edge chromiumversion unspecified
- cpe mozilla/firefoxversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe webmproject/libwebpversion unspecified
- vendor Google Chromium WebPversion unspecified
Sources
- CISA KEVCVE-2023-4863
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
cisa.gov - CVE.orgCVE-2023-4863
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-4863
30-day exploitation probability 100.0%
first.org - NIST NVDCVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
nvd.nist.gov