Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Loading...
Loading...
Score elevated to 9.0 because this CVE is listed on the CISA Known Exploited Vulnerabilities catalog (added 2023-09-13), indicating real-world exploitation has been confirmed by US federal agencies. NVD baseline CVSS 8.8 retained for reference. Confidence: HIGH.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
September 12, 2023
October 24, 2025
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| magick.net-q16-anycpu | 10.0.0 ... 9.1.2 (184 versions) | 13.3.0 | — |
| magick.net-q16-hdri-anycpu | 10.0.0 ... 9.1.2 (181 versions) | 13.3.0 | — |
| magick.net-q16-x64 | 10.0.0 ... 9.1.2 (200 versions) | 13.3.0 | — |
| magick.net-q8-anycpu | 10.0.0 ... 9.1.2 (184 versions) | 13.3.0 | — |
| magick.net-q8-openmp-x64 | 10.0.0 ... 9.1.2 (81 versions) | 13.3.0 | — |
| magick.net-q8-x64 | 10.0.0 ... 9.1.2 (200 versions) | 13.3.0 | — |
| SkiaSharp | 2.80.0 ... 2.88.5 (11 versions) | 2.88.6 | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| libwebp-sys | — | 0.9.3 | — |
| libwebp-sys2 | — | 0.1.8 | — |
| webp | — | 0.2.6 | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| github.com/chai2010/webp | — | 1.1.2-0.20250406010349-76805d5a8860 | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| electron | — | 27.0.0-beta.2 | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| pillow | 1.0 ... 9.5.0 (93 versions) | 10.0.1 | — |
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.
Chromium: CVE-2023-4863 Heap buffer overflow in WebP
RHBA-2023:5988 — Important
RHBA-2023:6004 — Important
RHSA-2023:5183 — Important
RHSA-2023:5184 — Important
RHSA-2023:5185 — Important
RHSA-2023:5186 — Important
RHSA-2023:5187 — Important
RHSA-2023:5188 — Important
RHSA-2023:5189 — Important
RHSA-2023:5190 — Important
RHSA-2023:5191 — Important
RHSA-2023:5192 — Important
RHSA-2023:5197 — Important
RHSA-2023:5198 — Important
RHSA-2023:5200 — Important
RHSA-2023:5201 — Important
RHSA-2023:5202 — Important
RHSA-2023:5204 — Important
RHSA-2023:5205 — Important
RHSA-2023:5214 — Important
RHSA-2023:5222 — Important
RHSA-2023:5223 — Important
RHSA-2023:5224 — Important
RHSA-2023:5236 — Important
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
Working exploit code is in the public domain (9 GitHub PoCs). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
This tool calculates tricky canonical huffman histogram for CVE-2023-4863.
Open source ↗A tool for finding vulnerable libwebp(CVE-2023-4863)
Open source ↗Find Electron Apps Vulnerable to CVE-2023-4863 / CVE-2023-5129
Open source ↗Scans an executable and determines if it was wrapped in an Electron version vulnerable to the Chromium vulnerability CVE-2023-4863/ CVE-2023-5129
Open source ↗BAD-WEBP-CVE-2023-4863
Open source ↗See which npm, PyPI, Go, and Maven packages are affected by CVE-2023-4863
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.
msrc · redhat
CWE-787