CVE-2023-4863
KEVHIGH 8.8EPSS 100.0%
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- Affected
- Google · Chrome · libwebp
- CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 99.98% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2023-09-13
- Published
- 2023-09-12
- Updated
- 2025-10-21
Proof-of-concept exploits (11)
- https://blog.isosceles.com/the-webp-0day/
- https://news.ycombinator.com/item?id=37478403
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- CrackerCat/CVE-2023-4863-1★ · 2024-02-03
- LiveOverflow/webp-CVE-2023-486356★ · 2024-05-13
- Trigii/CVE-2023-428603★ · 2024-09-12
- bbaranoff/CVE-2023-48636★ · 2026-01-05
- huiwen-yayaya/CVE-2023-48634★ · 2024-06-08
- maxen11/DroidHunter8★ · 2025-09-20
- mistymntncop/CVE-2023-4863319★ · 2023-12-18
- talbeerysec/BAD-WEBP-CVE-2023-48633★ · 2023-09-25
Security advisories
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway
- https://blog.isosceles.com/the-webp-0day
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://security.gentoo.org/glsa/202309-05
- https://security.gentoo.org/glsa/202401-10
- https://security.netapp.com/advisory/ntap-20230929-0011
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863
- https://www.bentley.com/advisories/be-2023-0001
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exp…
- https://www.debian.org/security/2023/dsa-5498
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40
- https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
- advisories/GHSA-j7hp-h8jx-5ppr
- webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://en.bandisoft.com/honeyview/history