CVE-2023-4863

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

How to fix CVE-2023-4863

To remediate CVE-2023-4863, upgrade the affected package to a fixed version below.

—upgrade to 1.4.0 or later
—upgrade to 2.88.6 or later
—upgrade to 13.3.0 or later
—upgrade to 13.3.0 or later
—upgrade to 13.3.0 or later
—upgrade to 13.3.0 or later
—upgrade to 13.3.0 or later
—upgrade to 13.3.0 or later
—upgrade to 0.9.3 or later
—upgrade to 0.9.3 or later
—upgrade to 0.1.8 or later
—upgrade to 0.1.8 or later
—upgrade to 0.2.6 or later
—upgrade to 22.3.24 or later

Is CVE-2023-4863 being exploited?

Yes — CVE-2023-4863 is on the CISA Known Exploited Vulnerabilities (KEV) catalog. Patch immediately.

Affected packages (14)

>= 1.1.2, < 1.4.0
>= 2.0.0, < 2.88.6
from 0, < 13.3.0
from 0, < 13.3.0
from 0, < 13.3.0
from 0, < 13.3.0
from 0, < 13.3.0
from 0, < 13.3.0
from 0, < 0.9.3
>= 0.0.0-0, < 0.9.3
from 0, < 0.1.8
>= 0.0.0-0, < 0.1.8
from 0, < 0.2.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H