CVE-2023-4863 is a critical vulnerability involving a heap buffer overflow in libwebp, affecting systems running Google Chrome versions prior to 116.0.5845.187 and libwebp 1.3.2. This vulnerability allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. It impacts various projects that use the libwebp library, including web browsers and other applications.

How do I know if I'm affected?

If you're using Google Chrome versions prior to 116.0.5845.187 or libwebp 1.3.2, you might be affected by this vulnerability. This critical vulnerability involves a heap buffer overflow in libwebp, which can be exploited by a remote attacker through a crafted HTML page. To check if you're affected, simply verify the version of your Google Chrome browser or the libwebp library in your system.

What should I do if I'm affected?

If you're affected by the CVE-2023-4863 vulnerability, it's crucial to update your software to protect your system. Update Google Chrome to version 116.0.5845.187 or later, libwebp to 1.3.2 or later, and other affected applications like Firefox, Thunderbird, and Microsoft Edge to their latest versions. Regularly check for updates and apply them promptly to stay secure.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-4863 vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog. Named "Google Chromium WebP Heap-Based Buffer Overflow Vulnerability," it was added on September 13, 2023, with a due date of October 4, 2023. The required action is to apply mitigations per vendor instructions or discontinue the use of the product if mitigations are unavailable.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as vulnerability CWE-787, which is an out-of-bounds write issue in the WebP Codec of the libwebp library, affecting various projects like Chrome and Firefox.

For more details

CVE-2023-4863 is a critical vulnerability with far-reaching implications for various software configurations. To gain a deeper understanding of its description, severity, technical details, and known affected software configurations, explore the NVD page or the links below.

• oss-security - CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

• oss-security - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

• oss-security - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

• oss-security - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec