CVE-2023-4863

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 99.98%
EPSS Percentile: 99.98%
CISA KEV: YES — Known Exploited Vulnerability

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Technical Details

CVSS Version: 3.1
CNA / NVD Source: chrome-cve-admin@google.com
Published: 12-Sep-2023 22:15
Last Modified: 17-Jun-2026 13:38
EPSS Date: 2026-10-18
CWE: CWE-787

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2023-09-13
Remediation Due: 2023-10-04
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1; https://nvd.nist.gov/vuln/detail/CVE-2023-4863

Affected Products / Versions

google / chrome
Version / affected range: * · before (exclusive) 116.0.5845.187
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
debian / debian_linux
Version / affected range: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debian / debian_linux
Version / affected range: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
debian / debian_linux
Version / affected range: 12.0
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
mozilla / firefox
Version / affected range: * · before (exclusive) 102.15.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
mozilla / firefox
Version / affected range: * · before (exclusive) 117.0.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
mozilla / firefox
Version / affected range: * · from (inclusive) 115.1.0 · before (exclusive) 115.2.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
mozilla / thunderbird
Version / affected range: * · before (exclusive) 102.15.1
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
mozilla / thunderbird
Version / affected range: * · from (inclusive) 115.0 · before (exclusive) 115.2.2
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
microsoft / edge_chromium
Version / affected range: * · before (exclusive) 116.0.1938.81
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
microsoft / teams
Version / affected range: * · before (exclusive) 1.6.00.26463
cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:*
microsoft / teams
Version / affected range: * · before (exclusive) 1.6.00.26474
cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:*
microsoft / webp_image_extension
Version / affected range: * · before (exclusive) 1.0.62681.0
cpe:2.3:a:microsoft:webp_image_extension:*:*:*:*:*:*:*:*
webmproject / libwebp
Version / affected range: * · before (exclusive) 1.3.2
cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*
netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
bentley / seequent_leapfrog
Version / affected range: * · before (exclusive) 2023.2
cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*
bandisoft / honeyview
Version / affected range: * · before (exclusive) 5.51
cpe:2.3:a:bandisoft:honeyview:*:*:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 02:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

cases, items that fell into the Chrome category were hiding much more interesting vulnerabilities. CVE-2023-4863 and CVE-2023-5217 caused quite a stir when they were initially published as vulnerabilities in Google Wiz Recaps Its 2023 Cloud Security Stories and Key Lessons
cause is in fact a bug in a dependency utilized by other products as well (such as the recent case of CVE-2023-4863, which was initially reported to only affect Chrome, but actually affected the WebP library). In this Eight Questions for Assessing Vulnerability Remediation Challenges
CVE-2023-4863 is a critical vulnerability in libwebp, and CVE-2023-5217 is a high severity vulnerability in libvpx, both reportedly exploited in the wild. Critical libwebp and libvpx flaws reportedly exploited in the wild
HomeBlogCritical Vulnerability: WebP Heap Buffer Overflow (CVE-2023-4863) Critical libwebp Heap Overflow Affects Software Using Versions Before 1.3.2

CVE (8)

People (8)

Threat Actors (8)

MITRE ATT&CK (1)

Vendors (7)

Products (13)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.