CVE-2023-4863

KEV
Published: Set 12, 2023 Last Modified: Ott 24, 2025
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,9408
Percentile
1,0th
Updated

EPSS Score Trend (Last 90 Days)

787

Out-of-bounds Write

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Unexpected State
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
Operating System

Debian Linux by Debian

Product Information
Vendor Debian
Product Debian Linux
Version 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Edge Chromium by Microsoft

Product Information
Vendor Microsoft
Product Edge Chromium
Version Range Affected
To 116.0.1938.81 (exclusive)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Teams by Microsoft

Product Information
Vendor Microsoft
Product Teams
Version Range Affected
To 1.6.00.26463 (exclusive)
cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Webp Image Extension by Microsoft

Product Information
Vendor Microsoft
Product Webp Image Extension
Version Range Affected
To 1.0.62681.0 (exclusive)
cpe:2.3:a:microsoft:webp_image_extension:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Libwebp by Webmproject

Product Information
Vendor Webmproject
Product Libwebp
Version Range Affected
To 1.3.2 (exclusive)
cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Active Iq Unified Manager by Netapp

Product Information
Vendor Netapp
Product Active Iq Unified Manager
Version -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Teams by Microsoft

Product Information
Vendor Microsoft
Product Teams
Version Range Affected
To 1.6.00.26474 (exclusive)
cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Debian Linux by Debian

Product Information
Vendor Debian
Product Debian Linux
Version 12.0
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Firefox by Mozilla

Product Information
Vendor Mozilla
Product Firefox
Version Range Affected
To 102.15.1 (exclusive)
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Firefox by Mozilla

Product Information
Vendor Mozilla
Product Firefox
Version Range Affected
From 115.1.0 (inclusive)
To 115.2.1 (exclusive)
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Chrome by Google

Product Information
Vendor Google
Product Chrome
Version Range Affected
To 116.0.5845.187 (exclusive)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Thunderbird by Mozilla

Product Information
Vendor Mozilla
Product Thunderbird
Version Range Affected
From 115.0 (inclusive)
To 115.2.2 (exclusive)
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Thunderbird by Mozilla

Product Information
Vendor Mozilla
Product Thunderbird
Version Range Affected
To 102.15.1 (exclusive)
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Honeyview by Bandisoft

Product Information
Vendor Bandisoft
Product Honeyview
Version Range Affected
To 5.51 (exclusive)
cpe:2.3:a:bandisoft:honeyview:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Fedora by Fedoraproject

Product Information
Vendor Fedoraproject
Product Fedora
Version 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Fedora by Fedoraproject

Product Information
Vendor Fedoraproject
Product Fedora
Version 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Fedora by Fedoraproject

Product Information
Vendor Fedoraproject
Product Fedora
Version 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Seequent Leapfrog by Bentley

Product Information
Vendor Bentley
Product Seequent Leapfrog
Version Range Affected
To 2023.2 (exclusive)
cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Debian Linux by Debian

Product Information
Vendor Debian
Product Debian Linux
Version 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Firefox by Mozilla

Product Information
Vendor Mozilla
Product Firefox
Version Range Affected
To 117.0.1 (exclusive)
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalo…
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023…
https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
https://blog.isosceles.com/the-webp-0day/
https://blog.isosceles.com/the-webp-0day/
https://bugzilla.suse.com/show_bug.cgi?id=1215231
https://bugzilla.suse.com/show_bug.cgi?id=1215231
https://chromereleases.googleblog.com/2023/09/stable-channe…
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop…
https://crbug.com/1479274
https://crbug.com/1479274
https://en.bandisoft.com/honeyview/history/
https://en.bandisoft.com/honeyview/history/
https://github.com/webmproject/libwebp/commit/902bc91903313…
https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2a…
https://github.com/webmproject/libwebp/releases/tag/v1.3.2
https://github.com/webmproject/libwebp/releases/tag/v1.3.2
https://lists.debian.org/debian-lts-announce/2023/09/msg000…
https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
https://lists.debian.org/debian-lts-announce/2023/09/msg000…
https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2023/09/msg000…
https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2…
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
https://news.ycombinator.com/item?id=37478403
https://news.ycombinator.com/item?id=37478403
https://security.gentoo.org/glsa/202309-05
https://security.gentoo.org/glsa/202309-05
https://security.gentoo.org/glsa/202401-10
https://security.gentoo.org/glsa/202401-10
https://security.netapp.com/advisory/ntap-20230929-0011/
https://security.netapp.com/advisory/ntap-20230929-0011/
https://security-tracker.debian.org/tracker/CVE-2023-4863
https://security-tracker.debian.org/tracker/CVE-2023-4863
https://sethmlarson.dev/security-developer-in-residence-wee…
https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
https://stackdiary.com/critical-vulnerability-in-webp-codec…
https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
https://www.bentley.com/advisories/be-2023-0001/
https://www.bentley.com/advisories/be-2023-0001/
https://www.bleepingcomputer.com/news/google/google-fixes-a…
https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-d…
https://www.debian.org/security/2023/dsa-5496
https://www.debian.org/security/2023/dsa-5496
https://www.debian.org/security/2023/dsa-5497
https://www.debian.org/security/2023/dsa-5497
https://www.debian.org/security/2023/dsa-5498
https://www.debian.org/security/2023/dsa-5498
https://www.mozilla.org/en-US/security/advisories/mfsa2023-…
https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
https://www.vicarius.io/vsociety/posts/zero-day-webp-vulner…
https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
http://www.openwall.com/lists/oss-security/2023/09/21/4
http://www.openwall.com/lists/oss-security/2023/09/21/4
http://www.openwall.com/lists/oss-security/2023/09/22/1
http://www.openwall.com/lists/oss-security/2023/09/22/1
http://www.openwall.com/lists/oss-security/2023/09/22/3
http://www.openwall.com/lists/oss-security/2023/09/22/3
http://www.openwall.com/lists/oss-security/2023/09/22/4
http://www.openwall.com/lists/oss-security/2023/09/22/4
http://www.openwall.com/lists/oss-security/2023/09/22/5
http://www.openwall.com/lists/oss-security/2023/09/22/5
http://www.openwall.com/lists/oss-security/2023/09/22/6
http://www.openwall.com/lists/oss-security/2023/09/22/6
http://www.openwall.com/lists/oss-security/2023/09/22/7
http://www.openwall.com/lists/oss-security/2023/09/22/7
http://www.openwall.com/lists/oss-security/2023/09/22/8
http://www.openwall.com/lists/oss-security/2023/09/22/8
http://www.openwall.com/lists/oss-security/2023/09/26/1
http://www.openwall.com/lists/oss-security/2023/09/26/1
http://www.openwall.com/lists/oss-security/2023/09/26/7
http://www.openwall.com/lists/oss-security/2023/09/26/7
http://www.openwall.com/lists/oss-security/2023/09/28/1
http://www.openwall.com/lists/oss-security/2023/09/28/1
http://www.openwall.com/lists/oss-security/2023/09/28/2
http://www.openwall.com/lists/oss-security/2023/09/28/2
http://www.openwall.com/lists/oss-security/2023/09/28/4
http://www.openwall.com/lists/oss-security/2023/09/28/4
https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
https://blog.isosceles.com/the-webp-0day/
https://blog.isosceles.com/the-webp-0day/
https://bugzilla.suse.com/show_bug.cgi?id=1215231
https://bugzilla.suse.com/show_bug.cgi?id=1215231
https://chromereleases.googleblog.com/2023/09/stable-channe…
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop…
https://crbug.com/1479274
https://crbug.com/1479274
https://en.bandisoft.com/honeyview/history/
https://en.bandisoft.com/honeyview/history/
https://github.com/webmproject/libwebp/commit/902bc91903313…
https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2a…
https://github.com/webmproject/libwebp/releases/tag/v1.3.2
https://github.com/webmproject/libwebp/releases/tag/v1.3.2
https://lists.debian.org/debian-lts-announce/2023/09/msg000…
https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
https://lists.debian.org/debian-lts-announce/2023/09/msg000…
https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2023/09/msg000…
https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/[email protected]…
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2…
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
https://news.ycombinator.com/item?id=37478403
https://news.ycombinator.com/item?id=37478403
https://security.gentoo.org/glsa/202309-05
https://security.gentoo.org/glsa/202309-05
https://security.gentoo.org/glsa/202401-10
https://security.gentoo.org/glsa/202401-10
https://security.netapp.com/advisory/ntap-20230929-0011/
https://security.netapp.com/advisory/ntap-20230929-0011/
https://security-tracker.debian.org/tracker/CVE-2023-4863
https://security-tracker.debian.org/tracker/CVE-2023-4863
https://sethmlarson.dev/security-developer-in-residence-wee…
https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
https://stackdiary.com/critical-vulnerability-in-webp-codec…
https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
https://www.bentley.com/advisories/be-2023-0001/
https://www.bentley.com/advisories/be-2023-0001/
https://www.bleepingcomputer.com/news/google/google-fixes-a…
https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-d…
https://www.debian.org/security/2023/dsa-5496
https://www.debian.org/security/2023/dsa-5496
https://www.debian.org/security/2023/dsa-5497
https://www.debian.org/security/2023/dsa-5497
https://www.debian.org/security/2023/dsa-5498
https://www.debian.org/security/2023/dsa-5498
https://www.mozilla.org/en-US/security/advisories/mfsa2023-…
https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
http://www.openwall.com/lists/oss-security/2023/09/21/4
http://www.openwall.com/lists/oss-security/2023/09/21/4
http://www.openwall.com/lists/oss-security/2023/09/22/1
http://www.openwall.com/lists/oss-security/2023/09/22/1
http://www.openwall.com/lists/oss-security/2023/09/22/3
http://www.openwall.com/lists/oss-security/2023/09/22/3
http://www.openwall.com/lists/oss-security/2023/09/22/4
http://www.openwall.com/lists/oss-security/2023/09/22/4
http://www.openwall.com/lists/oss-security/2023/09/22/5
http://www.openwall.com/lists/oss-security/2023/09/22/5
http://www.openwall.com/lists/oss-security/2023/09/22/6
http://www.openwall.com/lists/oss-security/2023/09/22/6
http://www.openwall.com/lists/oss-security/2023/09/22/7
http://www.openwall.com/lists/oss-security/2023/09/22/7
http://www.openwall.com/lists/oss-security/2023/09/22/8
http://www.openwall.com/lists/oss-security/2023/09/22/8
http://www.openwall.com/lists/oss-security/2023/09/26/1
http://www.openwall.com/lists/oss-security/2023/09/26/1
http://www.openwall.com/lists/oss-security/2023/09/26/7
http://www.openwall.com/lists/oss-security/2023/09/26/7
http://www.openwall.com/lists/oss-security/2023/09/28/1
http://www.openwall.com/lists/oss-security/2023/09/28/1
http://www.openwall.com/lists/oss-security/2023/09/28/2
http://www.openwall.com/lists/oss-security/2023/09/28/2
http://www.openwall.com/lists/oss-security/2023/09/28/4
http://www.openwall.com/lists/oss-security/2023/09/28/4