CVE-2023-4863 Google Chromium WebP Heap-Based Buffer Overflow
Remote attackers can execute arbitrary code via crafted HTML pages exploiting a heap buffer overflow in the libwebp library.
- Exploited in the wild
- Since 13 Sep 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-4863?
CVE-2023-4863 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Weakness: CWE-787
Which versions are affected by CVE-2023-4863?
40 open source packages ship an affected version, including electron, github.com/chai2010/webp and SkiaSharp. It affects 12 products.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | From 22.0.0 | 22.3.24 |
electron npm | From 22.0.0 | 22.3.24 |
electron npm | From 24.0.0 | 24.8.3 |
electron npm | From 24.0.0 | 24.8.3 |
electron npm | From 25.0.0 | 25.8.1 |
electron npm | From 25.0.0 | 25.8.1 |
34 more packages
electron npm | From 26.0.0 | 26.2.1 |
electron npm | From 26.0.0 | 26.2.1 |
github.com/chai2010/webp Go | All versions | 0.0.0-20250406010349-76805d5a8860 |
github.com/chai2010/webp Go | All versions | 0.0.0-20250406010349-76805d5a8860 |
github.com/chai2010/webp Go | From 0.0.0 | 1.1.2-0.20250406010349-76805d5a8860 |
github.com/chai2010/webp Go | From 0.0.0 | 1.1.2-0.20250406010349-76805d5a8860 |
github.com/chai2010/webp Go | From 1.1.2 | 1.4.0 |
github.com/chai2010/webp Go | From 1.1.2 | 1.4.0 |
SkiaSharp NuGet | From 2.0.0 | 2.88.6 |
SkiaSharp NuGet | From 2.0.0 | 2.88.6 |
magick.net-q16-anycpu NuGet | All versions | 13.3.0 |
magick.net-q16-anycpu NuGet | All versions | 13.3.0 |
magick.net-q16-hdri-anycpu NuGet | All versions | 13.3.0 |
magick.net-q16-hdri-anycpu NuGet | All versions | 13.3.0 |
magick.net-q16-x64 NuGet | All versions | 13.3.0 |
magick.net-q16-x64 NuGet | All versions | 13.3.0 |
magick.net-q8-anycpu NuGet | All versions | 13.3.0 |
magick.net-q8-anycpu NuGet | All versions | 13.3.0 |
magick.net-q8-openmp-x64 NuGet | All versions | 13.3.0 |
magick.net-q8-openmp-x64 NuGet | All versions | 13.3.0 |
magick.net-q8-x64 NuGet | All versions | 13.3.0 |
magick.net-q8-x64 NuGet | All versions | 13.3.0 |
Pillow PyPI | All versions | 10.0.1 |
opencv-contrib-python PyPI | All versions | 4.8.1.78 |
opencv-contrib-python-headless PyPI | All versions | 4.8.1.78 |
opencv-python PyPI | All versions | 4.8.1.78 |
opencv-python-headless PyPI | All versions | 4.8.1.78 |
pillow PyPI | All versions | 10.0.1 |
libwebp-sys crates.io | All versions | 0.9.3 |
libwebp-sys crates.io | All versions | 0.9.3 |
libwebp-sys2 crates.io | All versions | 0.1.8 |
libwebp-sys2 crates.io | All versions | 0.1.8 |
webp crates.io | All versions | 0.2.6 |
webp crates.io | All versions | 0.2.6 |
Products include Bandisoft Honeyview, Bentley Seequent Leapfrog, Debian Debian Linux, Fedoraproject Fedora, Google Chrome, Microsoft Edge Chromium and 6 more.
How do I fix CVE-2023-4863?
Upgrade electron to a fixed version for your release line: 22.3.24, 24.8.3, 25.8.1 or 26.2.1. US federal agencies must fix it by 4 Oct 2023.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-4863 being exploited?
Yes. Attackers have exploited CVE-2023-4863 in the wild since at least 13 Sep 2023.
Public exploit code: 14 proofs of concept on GitHub.
Sources
Also known as A-299477569, ALPINE-CVE-2023-4863, ALSA-2023:5184, ALSA-2023:5200, ALSA-2023:5201, ALSA-2023:5214 and 56 more.