CVE-2023-4863: libwebp Heap Buffer Overflow via Crafted WebP Image

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe vulnerability is in CISA KEV, has an EPSS probability near 1.0, is remotely reachable with no authentication, and affects a widely embedded image library.

What it is

A heap buffer overflow in libwebp allows an out-of-bounds memory write when processing a crafted WebP image. It affects Google Chrome before 116.0.5845.187 and libwebp before 1.3.2, and because libwebp is embedded in many browsers, applications and libraries, the exposure is broad. The flaw is remotely reachable and was exploited in the wild, making it a high-priority memory corruption issue.

Impact

An attacker can write out of bounds in heap memory, which can lead to code execution or a crash in the context of the affected process. Successful exploitation gives the attacker control over the vulnerable application's execution flow.

Attack surface

Reached remotely over the network by delivering a crafted HTML page or WebP image to a vulnerable renderer or image parser. No authentication is required, but user interaction is needed to load the malicious content, per the CVSS vector (AV:N/AC:L/PR:N/UI:R).

Exploitation

CVE-2023-4863 is listed in CISA KEV with a due date of 2023-10-04, and EPSS shows a 30-day probability of 0.99979 (99.98th percentile). A reference is tagged Exploit, confirming public exploit information exists.

What to do

• Update Google Chrome to 116.0.5845.187 or later and libwebp to 1.3.2 or later.
• Apply vendor patches for all listed affected products (Firefox, Thunderbird, Edge Chromium, Teams, Debian, Fedora, NetApp, Bentley, Bandisoft, WebP image extension).
• If immediate patching is not possible, follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product.
• Inventory applications and libraries that bundle libwebp, including third-party and embedded components, and patch them as well.
• Restrict rendering of untrusted WebP content where feasible until all dependent components are updated.

Detection

• Monitor for crashes or abnormal process terminations in browsers and image-processing applications that handle WebP content.
• Hunt for exploitation attempts by inspecting network and email traffic for WebP files or HTML pages that trigger memory corruption indicators.
• Check endpoint logs for suspicious child processes spawned by browser or image renderer processes after viewing WebP content.
• Verify patch status of Chrome, libwebp and all listed affected products across endpoints and servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.