CVE-2023-4863
High8.8CISA KEV — exploited in the wildGoogle Chromium WebP Heap-Based Buffer Overflow Vulnerabilityname from CISA KEV
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- CVSS
- 8.8v3.1
- EPSS (exploit probability)
- 100.0%100th pct
- CISA KEV
- Listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-27 | 100.0% | 100.0% |
| 2026-10-26 | 100.0% | 100.0% |
| 2026-10-25 | 100.0% | 100.0% |
| 2026-10-24 | 100.0% | 100.0% |
| 2026-10-23 | 100.0% | 100.0% |
| 2026-10-22 | 100.0% | 100.0% |
| 2026-10-21 | 100.0% | 100.0% |
| 2026-10-20 | 100.0% | 100.0% |
| 2026-10-19 | 100.0% | 100.0% |
| 2026-10-18 | 100.0% | 100.0% |
| 2026-10-17 | 100.0% | 100.0% |
| 2026-10-16 | 100.0% | 100.0% |
| 2026-10-15 | 100.0% | 100.0% |
| 2026-10-14 | 100.0% | 100.0% |
| 2026-10-13 | 100.0% | 100.0% |
| 2026-10-12 | 100.0% | 100.0% |
| 2026-10-11 | 100.0% | 100.0% |
| 2026-10-10 | 100.0% | 100.0% |
| 2026-10-09 | 100.0% | 100.0% |
| 2026-10-08 | 100.0% | 100.0% |
| 2026-10-07 | 100.0% | 100.0% |
| 2026-10-06 | 100.0% | 100.0% |
| 2026-10-05 | 100.0% | 100.0% |
| 2026-10-04 | 100.0% | 100.0% |
| 2026-10-03 | 100.0% | 100.0% |
| 2026-10-02 | 100.0% | 100.0% |
| 2026-10-01 | 100.0% | 100.0% |
| 2026-09-30 | 100.0% | 100.0% |
| 2026-09-29 | 100.0% | 100.0% |
| 2026-09-28 | 100.0% | 100.0% |
| 2026-09-27 | 100.0% | 100.0% |
CISA KEV entrycatalogue 2026.10.26
- Date added
- 2023-09-13
- Federal due date
- 2023-10-04
- Known ransomware use
- Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Verbatim from the CISA KEV catalogue (CISA KEV, fetched 2026-10-27 17:23 UTC). The due date applies to US federal agencies under BOD 22-01.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
- google chrome
- fedoraproject fedora
- debian debian linux
- mozilla firefox
- mozilla thunderbird
- microsoft edge chromium
- microsoft teams
- microsoft webp image extension
- webmproject libwebp
- netapp active iq unified manager
- bentley seequent leapfrog
- bandisoft honeyview
Coverage1 article
References
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://blog.isosceles.com/the-webp-0day/
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history/
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/