Critical libwebp Heap Overflow Affects Software Using Versions Before 1.3.2
Summary
CVE-2023-4863 is a libwebp heap buffer overflow triggered by crafted WebP images. Huntress reproduced the overflow but had not verified a full exploit; it recommends identifying affected software and patching to libwebp 1.3.2 or vendor-fixed versions.
Key points
- A crafted lossless WebP image can trigger an out-of-bounds heap write during decoding in vulnerable libwebp versions before 1.3.2.
- The flaw may cause denial of service or potentially remote code execution; software only needs to consume the crafted image for the overflow to trigger.
- Google reported that an exploit existed in the wild, while Huntress said it had reproduced the buffer overflow but had not verified a full exploitation chain.
- A full list of affected software was not available. Potentially affected products include browsers, operating systems, Electron-based applications, and desktop clients that bundle libwebp.
- Huntress recommends inventorying software that uses libwebp and updating to version 1.3.2 or vendor-patched releases; browser updates are an immediate step.
Article Details
- Vulnerability Types
- Heap buffer overflow
- Out-of-bounds write
- Severity
- Critical
- Affected Versions
- libwebp versions prior to 1.3.2
- Google Chrome versions prior to 116.0.5845.187
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Update libwebp and affected applications to patched versions; update web browsers.
MITRE ATT&CK
CVE
People
Vendors
Products
Google Chromesimilar to the JPG, PNG, and SVG formats and is natively supported by most common web browsers like Google Chrome, Safari, Firefox, and Edge.libwebpinvestigating CVE-2023-4863, a heap buffer overflow in the WebP image encoding/decoding (codec) library (libwebp). Threat actors are exploiting this critical vulnerability in the wild, which affects anything using the