What is CVE-2023-4863?

CVE-2023-4863 is a critical vulnerability involving a heap buffer overflow in libwebp, affecting systems running Google Chrome versions prior to 116.0.5845.187 and libwebp 1.3.2.

This vulnerability allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. It impacts various projects that use the libwebp library, including web browsers and other applications.

Who Is Impacted By CVE-2023-4863?

If you're using Google Chrome versions prior to 116.0.5845.187 or libwebp 1.3.2, you might be affected by this vulnerability. This critical vulnerability involves a heap buffer overflow in libwebp, which can be exploited by a remote attacker through a crafted HTML page.

To check if you're affected, simply verify the version of your Google Chrome browser or the libwebp library in your system.

What To Do If CVE-2023-4863 Affected You

If you're affected by the CVE-2023-4863 vulnerability, it's crucial to update your software to protect your system. Update Google Chrome to version 116.0.5845.187 or later, libwebp to 1.3.2 or later, and other affected applications like Firefox, Thunderbird, and Microsoft Edge to their latest versions. Regularly check for updates and apply them promptly to stay secure.

Is CVE-2023-4863 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-4863 vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog. Named "Google Chromium WebP Heap-Based Buffer Overflow Vulnerability," it was added on September 13, 2023, with a due date of October 4, 2023. The required action is to apply mitigations per vendor instructions or discontinue the use of the product if mitigations are unavailable.

CVE-2023-4863 Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as vulnerability CWE-787, which is an out-of-bounds write issue in the WebP Codec of the libwebp library, affecting various projects like Chrome and Firefox.

Learn More

CVE-2023-4863 is a critical vulnerability with far-reaching implications for various software configurations.

To gain a deeper understanding of its description, severity, technical details, and known affected software configurations, explore the NVD page or the links below.

• oss-security - CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

• oss-security - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

• oss-security - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

• oss-security - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec