CVE-2023-4863

critical-risk
Published 2023-09-12

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Do I need to act?

!
93.6% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (18)

Libwebp

Affected Vendors

Debian Microsoft Mozilla Google Fedoraproject Netapp Webmproject Bentley Bandisoft

References (92)

Mailing List http://www.openwall.com/lists/oss-security/2023/09/21/4
Mailing List http://www.openwall.com/lists/oss-security/2023/09/22/1
Mailing List http://www.openwall.com/lists/oss-security/2023/09/22/3
Mailing List http://www.openwall.com/lists/oss-security/2023/09/22/4
Mailing List http://www.openwall.com/lists/oss-security/2023/09/22/5
Mailing List http://www.openwall.com/lists/oss-security/2023/09/22/6
Mailing List http://www.openwall.com/lists/oss-security/2023/09/22/7
Mailing List http://www.openwall.com/lists/oss-security/2023/09/22/8
Mailing List http://www.openwall.com/lists/oss-security/2023/09/26/1
Mailing List http://www.openwall.com/lists/oss-security/2023/09/26/7
Mailing List http://www.openwall.com/lists/oss-security/2023/09/28/1
Mailing List http://www.openwall.com/lists/oss-security/2023/09/28/2
Mailing List http://www.openwall.com/lists/oss-security/2023/09/28/4
Third Party Advisory https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
Exploit https://blog.isosceles.com/the-webp-0day/
Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1215231
Vendor Advisory https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_...
Issue Tracking https://crbug.com/1479274
Release Notes https://en.bandisoft.com/honeyview/history/
Patch https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab...
and 72 more references
76
/ 100
critical-risk
Severity 30/34 · Critical
Exploitability 27/34 · High
Exposure 19/34 · Moderate