CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2023-4863
High (8.8) in Google Chromium WebP. In CISA KEV since 2023-09-13. EPSS 100% chance of exploitation in the next 30 days. Fixed in libwebp-sys2 0.1.8.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2023-09-13, due 2023-10-04
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bandisoft:honeyview
- bentley:seequent_leapfrog
- debian:debian_linux
- fedoraproject:fedora
- google:chrome
- microsoft:edge_chromium
- microsoft:teams
- microsoft:webp_image_extension
- mozilla:firefox
- mozilla:thunderbird
- netapp:active_iq_unified_manager
- webmproject:libwebp
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j7hp-h8jx-5ppr | crates.io | libwebp-sys2 | <0.1.8 | 0.1.8 |
| GHSA-j7hp-h8jx-5ppr | crates.io | libwebp-sys | <0.9.3 | 0.9.3 |
| GHSA-j7hp-h8jx-5ppr | npm | electron | >=22.0.0 <22.3.24 | 22.3.24 |
| GHSA-j7hp-h8jx-5ppr | npm | electron | >=24.0.0 <24.8.3 | 24.8.3 |
| GHSA-j7hp-h8jx-5ppr | npm | electron | >=25.0.0 <25.8.1 | 25.8.1 |
| GHSA-j7hp-h8jx-5ppr | npm | electron | >=26.0.0 <26.2.1 | 26.2.1 |
| GHSA-j7hp-h8jx-5ppr | npm | electron | >=27.0.0-beta.1 <27.0.0-beta.2 | 27.0.0-beta.2 |
| GHSA-j7hp-h8jx-5ppr | NuGet | SkiaSharp | >=2.0.0 <2.88.6 | 2.88.6 |
| GHSA-j7hp-h8jx-5ppr | Go | github.com/chai2010/webp | >=1.1.2 <1.4.0 | 1.4.0 |
| GHSA-j7hp-h8jx-5ppr | PyPI | pillow | <10.0.1 | 10.0.1 |
| GHSA-j7hp-h8jx-5ppr | crates.io | webp | <0.2.6 | 0.2.6 |
| GHSA-j7hp-h8jx-5ppr | NuGet | magick.net-q16-anycpu | <13.3.0 | 13.3.0 |
| GHSA-j7hp-h8jx-5ppr | NuGet | magick.net-q16-hdri-anycpu | <13.3.0 | 13.3.0 |
| GHSA-j7hp-h8jx-5ppr | NuGet | magick.net-q16-x64 | <13.3.0 | 13.3.0 |
| GHSA-j7hp-h8jx-5ppr | NuGet | magick.net-q8-anycpu | <13.3.0 | 13.3.0 |
| GHSA-j7hp-h8jx-5ppr | NuGet | magick.net-q8-openmp-x64 | <13.3.0 | 13.3.0 |
| GHSA-j7hp-h8jx-5ppr | NuGet | magick.net-q8-x64 | <13.3.0 | 13.3.0 |
| GHSA-j7hp-h8jx-5ppr | Go | github.com/chai2010/webp | <0.0.0-20250406010349-76805d5a8860 | 0.0.0-20250406010349-76805d5a8860 |
| GHSA-j7hp-h8jx-5ppr | Go | github.com/chai2010/webp | >=0.0.0 <1.1.2-0.20250406010349-76805d5a8860 | 1.1.2-0.20250406010349-76805d5a8860 |
| PYSEC-2026-1794 | PyPI | pillow | <10.0.1 | 10.0.1 |
| RUSTSEC-2023-0060 | crates.io | libwebp-sys2 | >=0.0.0-0 <0.1.8 | 0.1.8 |
| RUSTSEC-2023-0061 | crates.io | libwebp-sys | >=0.0.0-0 <0.9.3 | 0.9.3 |