CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
First published: Wed Sep 06 2023(Updated: )
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2023">Google Chrome Releases</a> for more information.</p> <p>Google is aware that an exploit for CVE-2023-4863 exists in the wild.</p>
Credit: Apple Security Engineering TorontoArchitecture (SEAR) TorontoThe Citizen Lab at The University Toronto chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Teams for Desktop | ||
| Microsoft Teams for Mac | ||
| Microsoft VP9 Video Extensions | ||
| Microsoft WebP Image Extension | ||
| Microsoft Skype | ||
| nuget/magick.net-q8-x64 | <13.3.0 | 13.3.0 |
| nuget/magick.net-q8-openmp-x64 | <13.3.0 | 13.3.0 |
| nuget/magick.net-q8-anycpu | <13.3.0 | 13.3.0 |
| nuget/magick.net-q16-x64 | <13.3.0 | 13.3.0 |
| nuget/magick.net-q16-hdri-anycpu | <13.3.0 | 13.3.0 |
| nuget/magick.net-q16-anycpu | <13.3.0 | 13.3.0 |
| rust/webp | <0.2.6 | 0.2.6 |
| pip/Pillow | <10.0.1 | 10.0.1 |
| go/github.com/chai2010/webp | >=1.0.0 | |
| nuget/SkiaSharp | >=2.0.0<2.88.6 | 2.88.6 |
| npm/electron | >=27.0.0-beta.1<27.0.0-beta.2 | 27.0.0-beta.2 |
| npm/electron | >=26.0.0<26.2.1 | 26.2.1 |
| npm/electron | >=25.0.0<25.8.1 | 25.8.1 |
| npm/electron | >=24.0.0<24.8.3 | 24.8.3 |
| npm/electron | >=22.0.0<22.3.24 | 22.3.24 |
| rust/libwebp-sys | <0.9.3 | 0.9.3 |
| rust/libwebp-sys2 | <0.1.8 | 0.1.8 |
| Microsoft Edge | <117.0.2045.31 | |
| Microsoft Edge (Chromium-based) | ||
| Mozilla Firefox | <117.0.1 | 117.0.1 |
| Mozilla Firefox ESR | <102.15.1 | 102.15.1 |
| Mozilla Firefox ESR | <115.2.1 | 115.2.1 |
| Mozilla Thunderbird | <102.15.1 | 102.15.1 |
| Mozilla Thunderbird | <115.2.2 | 115.2.2 |
| Google Chrome | <116.0.5845.187 | |
| Fedoraproject Fedora | =37 | |
| Fedoraproject Fedora | =38 | |
| Fedoraproject Fedora | =39 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Debian Debian Linux | =12.0 | |
| Mozilla Firefox | <117.0.1 | |
| Mozilla Firefox ESR | <102.15.1 | |
| Mozilla Firefox ESR | >=115.0<115.2.1 | |
| Mozilla Thunderbird | <102.15.1 | |
| Mozilla Thunderbird | >=115.0<115.2.2 | |
| Microsoft Edge | <117.0.2045.31 | |
| Webmproject Libwebp | <1.3.2 | |
| Microsoft Edge Chromium | <117.0.5938.62 | |
| Microsoft Teams | =1.6.00.26463 | |
| Microsoft Teams Desktop | =1.6.00.26474 | |
| Microsoft WebP Image Extension | =1.0.62681.0 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Bentley Seequent Leapfrog | <2023.2 | |
| Google Chromium WebP | ||
| Google Chrome | <116.0.5845.187 | 116.0.5845.187 |
| Google Android | ||
| debian/chromium | 120.0.6099.224-1~deb11u1 128.0.6613.84-1~deb12u1 130.0.6723.69-1~deb12u1 129.0.6668.89-1 130.0.6723.69-1 | |
| debian/firefox | 131.0.3-1 | |
| debian/firefox-esr | 115.14.0esr-1~deb11u1 128.3.1esr-1~deb11u1 115.14.0esr-1~deb12u1 128.3.1esr-1~deb12u1 128.3.1esr-2 | |
| debian/libwebp | 0.6.1-2.1+deb11u2 1.2.4-0.2+deb12u1 1.4.0-0.1 | |
| debian/thunderbird | 1:115.12.0-1~deb11u1 1:115.16.0esr-1~deb11u1 1:115.12.0-1~deb12u1 1:115.16.0esr-1~deb12u1 1:128.3.2esr-1 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 (Advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://github.com/qnighy/libwebp-sys2-rs/pull/21
- https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://en.bandisoft.com/honeyview/history/
- https://news.ycombinator.com/item?id=37478403
- https://rustsec.org/advisories/RUSTSEC-2023-0060.html
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- https://github.com/electron/electron/pull/39823
- https://github.com/electron/electron/pull/39825
- https://github.com/electron/electron/pull/39826
- https://github.com/electron/electron/pull/39827
- https://github.com/electron/electron/pull/39828
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
- https://rustsec.org/advisories/RUSTSEC-2023-0061.html
- https://security.gentoo.org/glsa/202309-05
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://www.debian.org/security/2023/dsa-5498
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://blog.isosceles.com/the-webp-0day/
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- https://github.com/jaredforth/webp/pull/30
- https://github.com/python-pillow/Pillow/pull/7395
- https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
- https://security.netapp.com/advisory/ntap-20230929-0011/
- https://github.com/ImageMagick/ImageMagick/discussions/6664
- https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0
- https://security.gentoo.org/glsa/202401-10
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
- https://www.bentley.com/advisories/be-2023-0001/
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr (Advisory)
- https://launchpad.net/bugs/cve/CVE-2023-4863
- https://www.bleepingcomputer.com/news/security/google-fixes-first-actively-exploited-chrome-zero-day-of-2024/
- https://www.cve.org/CVERecord?id=CVE-2023-4863
- https://bugzilla.mozilla.org/show_bug.cgi?id=1852649
- https://bugs.chromium.org/p/chromium/issues/detail?id=1479274
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/#CVE-2023-4863
- https://www.theregister.com/2024/03/27/surge_in_enterprise_zero_days/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238433
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238432
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238543
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238431#c3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238950
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238951
- https://chromium.googlesource.com/webm/libwebp.git/+/902bc9190331343b2017211debcec8d2ab87e17a%5E%21/
- https://chromium.googlesource.com/webm/libwebp.git/+/95ea5226c870449522240ccff26f0b006037c520%5E%21/#F0
- https://chromium.googlesource.com/webm/libwebp/+/902bc91
- https://access.redhat.com/errata/RHSA-2023:5185
- https://access.redhat.com/errata/RHSA-2023:5184
- https://access.redhat.com/errata/RHSA-2023:5183
- https://access.redhat.com/errata/RHSA-2023:5188
- https://access.redhat.com/errata/RHSA-2023:5187
- https://access.redhat.com/errata/RHSA-2023:5186
- https://access.redhat.com/errata/RHSA-2023:5190
- https://access.redhat.com/errata/RHSA-2023:5192
- https://access.redhat.com/errata/RHSA-2023:5189
- https://access.redhat.com/errata/RHSA-2023:5198
- https://access.redhat.com/errata/RHSA-2023:5197
- https://access.redhat.com/errata/RHSA-2023:5191
- https://access.redhat.com/errata/RHSA-2023:5202
- https://access.redhat.com/errata/RHSA-2023:5201
- https://access.redhat.com/errata/RHSA-2023:5200
- https://access.redhat.com/errata/RHSA-2023:5204
- https://access.redhat.com/errata/RHSA-2023:5205
- https://access.redhat.com/errata/RHSA-2023:5222
- https://access.redhat.com/errata/RHSA-2023:5223
- https://access.redhat.com/errata/RHSA-2023:5214
- https://access.redhat.com/errata/RHSA-2023:5224
- https://access.redhat.com/errata/RHSA-2023:5236
- https://access.redhat.com/errata/RHSA-2023:5309
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2240759
- https://bugzilla.redhat.com/show_bug.cgi?id=2238431
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1; (Advisory)
- https://source.android.com/docs/security/bulletin/2023-10-01 (Advisory)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863
- https://ubuntu.com/security/CVE-2023-4863
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2023-4863?
CVE-2023-4863 is a vulnerability in Google Chromium WebP that allows a remote attacker to perform an out-of-bounds memory write.
Which software is affected by CVE-2023-4863?
Microsoft Edge (Chromium-based), Google Chromium WebP, Microsoft Edge, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, and libwebp are affected by CVE-2023-4863.
What is the severity of CVE-2023-4863?
CVE-2023-4863 has a severity rating of critical (8.8).
How can I fix the CVE-2023-4863 vulnerability?
To fix the CVE-2023-4863 vulnerability, update your software to the latest version provided by the respective vendors or apply the available patches.
Where can I find more information about CVE-2023-4863?
You can find more information about CVE-2023-4863 on the Microsoft Security Response Center (MSRC) website, Google Chrome Releases blog, and Bugzilla Mozilla website.
- collector/oss-sec
- alias/CVE-2023-4863
- collector/msrc
- collector/msrc-cve
- collector/github-advisory-latest
- alias/GHSA-j7hp-h8jx-5ppr
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- exploited/true
- source/Microsoft
- agent/software-canonical-lookup
- agent/severity
- agent/title
- agent/author
- collector/github-advisory
- source/GitHub
- agent/description
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-0519
- alias/CVE-2024-0517
- alias/CVE-2024-0518
- alias/CVE-2023-7024
- alias/CVE-2023-6345
- alias/CVE-2023-5217
- alias/CVE-2023-3079
- alias/CVE-2023-4762
- alias/CVE-2023-2136
- alias/CVE-2023-2033
- agent/software-canonical-lookup-request
- collector/mozilla-advisory
- source/Mozilla
- collector/the-register
- source/The Register
- alias/CVE-2023-41064
- alias/CVE-2023-2868
- alias/CVE-2023-7102
- alias/CVE-2022-41328
- alias/CVE-2023-20867
- alias/CVE-2023-34048
- zeroday/true
- agent/news-ai
- agent/weakness
- agent/remedy
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- collector/mitre-cve
- source/MITRE
- collector/cisa-known-exploited
- source/CISA
- collector/chrome-releases
- agent/references
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/android-source
- source/Android
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- vendor/microsoft
- canonical/microsoft teams for desktop
- canonical/microsoft teams for mac
- canonical/microsoft vp9 video extensions
- canonical/microsoft webp image extension
- canonical/microsoft skype
- package-manager/nuget
- package-manager/rust
- package-manager/pip
- package-manager/go
- package-manager/npm
- canonical/microsoft edge
- canonical/microsoft edge (chromium-based)
- vendor/mozilla
- canonical/mozilla firefox
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird
- vendor/google
- canonical/google chrome
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/37
- version/fedoraproject fedora/38
- version/fedoraproject fedora/39
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- version/debian debian linux/12.0
- version/mozilla firefox esr/115.0
- version/mozilla thunderbird/115.0
- vendor/webmproject
- canonical/webmproject libwebp
- canonical/microsoft edge chromium
- canonical/microsoft teams
- version/microsoft teams/1.6.00.26463
- canonical/microsoft teams desktop
- version/microsoft teams desktop/1.6.00.26474
- version/microsoft webp image extension/1.0.62681.0
- vendor/netapp
- canonical/netapp active iq unified manager vmware vsphere
- vendor/bentley
- canonical/bentley seequent leapfrog
- canonical/google chromium webp
- package-manager/debian
- canonical/google android