Heap Buffer Overflow in libwebp Allows Remote Attacker to Write Out of Bounds Memory
CVE-2023-4863

8.8HIGH

Key Information:

Vendor: Google
Status: Chrome; Libwebp
Vendor: CVE Published:; 12 September 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 47%🦅 CISA Reported📰 News Worthy

Summary

A heap buffer overflow vulnerability has been identified in Google Chrome and libwebp, which could allow remote attackers to perform out-of-bounds memory writes. This security issue arises when specially crafted HTML pages are processed, potentially leading to significant impacts on the affected systems. It is crucial for users to update their versions of Google Chrome and libwebp to the latest ones to mitigate the risks associated with this vulnerability. The vulnerability has been addressed in the recent stable updates by Google, underscoring the importance of timely software updates in maintaining security.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Chrome 116.0.5845.187

libwebp 1.3.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-4863
Created by mistymntncop

webp-CVE-2023-4863
Created by LiveOverflow

NotEnough
Created by caoweiquan322

News Articles

Upwind Security

CVE-2023-4863 CVE-2023-41064

WebP Zero-Day: Everything You Need to Know About Libwebp - Upwind

This month, the Citizen Lab at The University of Toronto’s Munk School and Apple Security Engineering and Architecture (SEA) opened two critical vulnerabilities related to WebP images and Google’s webmproject/libwebp library. So, what is Libwebp? Libwebp is a commonly used library used to render W...

2 months ago

Krebs on Security

CVE-2023-4863 CVE-2023-36761

Adobe, Apple, Google & Microsoft Patch 0-Day Bugs

Microsoft today issued software updates to fix at least five dozen security holes in Windows and supported software, including patches for two zero-day vulnerabilities that are already being exploited. Also, Adobe, Google Chrome and Apple iOS users may have their…

7 months ago